The landscape of cybersecurity is in constant flux. Both criminal organizations and nation-states continually leverage new technologies, such as AI, to exploit fresh vulnerabilities while relying on traditional tactics. While prioritizing prevention remains crucial, many business leaders acknowledge that cyberattacks may breach even the most robust defenses. Swift detection, response, and recovery now hold greater importance in minimizing damage and reinstating resilience effectively.

The ability to withstand cyber assaults is pivotal for upholding business operations, fostering customer confidence, and mitigating the repercussions of future attacks. Worldwide regulators are increasingly directing their focus towards cyber resilience, mandating organizations to exhibit greater transparency regarding their capacity to address security breaches both during and after an incident.

Post a breach, the objective isn’t just recuperation but fortification—a transformation that renders the organization less susceptible to future attacks, more secure, and notably resilient. Within this eBook, PraeLegal’s experts impart their insights to empower organizations in confronting cyber threats confidently and proactively. Their guidance aims not only to navigate through cyber incidents but to emerge fortified and more robust than before.

The post Vigilance and Resilience in the Cyberspace: Recovering from Cyberattacks, Building Back Stronger, and Avoiding Complacency appeared first on PraeLegal.

In today’s data-driven digital economy, trust within your business stands as the linchpin for success. Amidst an environment rife with uncertainty and constant evolution, where the velocity of change is exponential, stakeholders – customers, employees, and investors – are opting for companies that embody trustworthiness and offer reliable services.

The rapid surge of transformative technologies like 5G networks, artificial intelligence (AI), machine learning (ML), virtual reality, and quantum computing underscores the pivotal role of contemporary cybersecurity and data-safeguarding strategies in forging and sustaining digital trust.

A recent report by the World Economic Forum (WEF), in collaboration with PRAELEGAL as part of the WEF’s Digital Trust Initiative, sounds the alarm about a ‘growing trust deficit’ between the public and current technology providers. This cautionary observation arises due to the ubiquitous embrace of modern digital technologies and the expansive nature of consumer data.

The report highlights an alarming downturn in public trust regarding technology usage, citing a consistent erosion of trust ‘year on year’ as our reliance on digital networks and technologies intensifies.

Indeed, PRAELEGAL’s Cyber Trust Insights 2022 report underscores an unprecedented ‘data deluge,’ as organizations mine and invest extensively in data-driven initiatives. While leveraging data for timely insights and modern customer experiences, concerns about the effective protection, utilization, and sharing of this data are mounting.

According to PRAELEGAL’s survey of business leaders this year, a significant 78 percent acknowledge that the adoption of AI and ML solutions for big data analytics presents distinct cybersecurity challenges. Additionally, three-quarters express concerns about the ethical and privacy ramifications stemming from the increased use of AI and ML.

Diminishing trust corrodes brand equity, customer relationships, and profitability. Undeniably, trust stands as a critical factor for any organization’s brand, reputation, profitability, and sustained relationships in today’s landscape of rapidly evolving business systems. These systems must demonstrate resilience, reliability, and swift responsiveness in the face of escalating threats such as data breaches and sophisticated cyber-attacks.

However, the WEF unequivocally warns that businesses are falling short of meeting public expectations concerning effective technology and data utilization. The report states, “Citizens and consumers are beginning to demand that companies and technology developers take their values seriously in terms of privacy, data usage, and integration. Companies failing to develop technologies aligned with these expectations can no longer anticipate widespread adoption.”

The WEF report introduces a comprehensive framework developed in collaboration with leading technology firms and consumer-centric companies, alongside government representatives from the US, the European Commission, Singapore, and prominent consumer advocates.

The WEF’s Digital Trust Framework urges companies to commit to cultivating digital trust and making more informed decisions about technology use to reverse the disconcerting trend. The report asserts, “Trust isn’t merely about the technologies developed or deployed but hinges on the decisions made by leaders.”

This framework stresses the significance of commitments in pivotal areas like cybersecurity, privacy, transparency, fairness, and safety, aiming to ameliorate the dwindling trust in novel technologies and their providers. It encapsulates explicit objectives to bolster digital trust, accompanied by a roadmap guiding companies on how to enhance trustworthiness in technology use and development through dedicated digital trust initiatives.

Five Key Steps to Cultivating Digital Trust

The WEF’s insightful report should be a staple in every CEO’s reading list as organizations navigate the swiftly evolving technological landscape amidst the expanding trust deficit. At PRAELEGAL, our collaboration with clients involves providing extensive support and guidance in tackling this critical challenge. PRAELEGAL identifies five crucial steps to foster trust through cybersecurity:

Embed trust and security across your organization holistically, seamlessly integrating cybersecurity and data protection into every facet of business – from strategy and planning to customer interactions, investments, governance, and culture.

Foster internal alliances by collaborating with key stakeholders such as the Chief Data Officer and Chief Privacy Officer to instill and sustain digital trust. Clearly define and reinforce the roles and responsibilities of each stakeholder. This includes CISOs gaining deeper insights into the overall functioning of the organization beyond security prerequisites.

Redefine the role of the CISO, acknowledging their potential to contribute significantly in an era driven by data. CISOs need to address a broader spectrum of agendas, encompassing ethical aspects of AI and ESG. A third of executives surveyed feel their CISOs lack the influence necessary to safeguard the organization and its data.

Garner support from leadership, particularly the C-suite and the board, as this backing significantly amplifies the CISO’s capability to champion the cause of trust. This necessitates a shift in the CISO’s role from a traditionally narrow technical focus to a strategic position within the organization. Half of the executives surveyed express doubt about the current level of ‘high trust’ characterizing the relationship between the board and the CISO.

Collaborate extensively with ecosystem partners and suppliers to fortify trust and resilience within a ‘trusted community.’ While our study highlights that 79 percent of organizations deem collaborative engagement with suppliers and customers critical, only 42 percent are actively engaging in such partnerships.

Daniel Dobrygowski, Head of Governance and Trust at the WEF, emphasizes, “A pivotal choice we face in the 21st century is whether to collectively build trust or witness the failure of innovation. By prioritizing individual values and expectations and committing to safety, reliability, accountability, inclusive, ethical, and responsible technology usage, we can render the technology we develop more trustworthy.

The post Collaborative Pursuit of Digital Trust The Increasing Significance of Trust in an Interconnected World appeared first on PraeLegal.

It is an excerpt that evaluates the system security of crypto coins and the hacking incidents. (Chainalysis 2020 Crypto Crime Report)

More cryptocurrencies have been hacked in 2019 and all other years. But none of the 11 attacks this year came close to the scale of major robberies like last year’s $ 534 million Coincheck hack or $ 473 million Mt. Therefore, despite the increasing number of attacks, the total amount stolen from exchanges sharply fell to $ 283 million worth of cryptocurrency.

The value for the total USD stolen by years and the number of attacks.

Currencies included: ADA, BCH, BTC, ETH, EOS, LTC, NANO, NEM, USDT, XRP and others (The value for the total USD stolen by years and the number of attacks).

Let us explain how we reached the final number of 2019 exchange attacks, given that other sources in the media and elsewhere may report different numbers:

• We enumerated attacks involving exploitation of technical vulnerabilities as well as attacks carried out by social engineering or other forms of deception.
• We counted attacks that only allowed bad actors to access funds from exchanges, not payment processors, wallet providers, investment platforms or other types of services.
• We did not take into account the situations of users exploiting a trade error, such as exit scams or pricing inconsistency that almost allowed a Synthetix user to exceed $ 1 billion in erroneous trades.
• We only included attacks where the amount stolen was measured and publicly approved by multiple sources. This means that we do not include cases where exchanges’ user data is compromised but no cryptocurrency is stolen. We have also excluded attacks that have been specifically reported to us, but we are confident that including them will not significantly distort the data we analyze here.

Under these restrictions, almost all of the attacks we didn’t include were on smaller exchanges for relatively low amounts of cryptocurrency. Therefore, our total quantity estimates in swap attacks are probably a lower limit, but we believe it is not far from the true total.

2019 Change Attacks Measured

Currencies included: ADA, BCH, BTC, ETH, EOS, LTC, NANO, NEM, USDT, XRP and others (see table “Amount of Exchange Attacks 2019”.)

As there were no more than $ 105 million hacks stolen from Coinbene, the average and median amount stolen per hack dropped significantly in 2019 after raising each of the previous three years. Only 54% of the attacks we observed in 2019 earned more than $ 10 million compared to all hacks in 2018. While the increase in the number of individual attacks is alarming, data show that exchanges are getting better at limiting damage.

Where do the funds go after the attacks?

Using blockchain analysis, we can analyze the movements of funds stolen in hacks to get an idea of how hackers liquidate funds.

Most of the funds stolen in currency attacks are sent to other exchanges, where they are probably cashed out. However, a significant portion of the funds have not been spent, sometimes for years. In such cases, there may still be an opportunity for law enforcement to confiscate stolen funds. And as we will discover later, a small but significant portion of all stolen funds (and increasingly in 2019) are being passed through third-party mixers or CoinJoin wallets to hide their illegal origin. However, the mixed funds in the above table are categorized according to their ultimate goal after the mixing takes place.

Hackers are responding to the security measures of the exchanges.

Exchanges have taken steps to better protect clients’ funds from attacks, and the sharp declines in the amount lost per hack show they have been successful. Many exchanges now hold a lower percentage of funds on less secure hot wallets, require more withdrawal powers, and monitor transactions more closely for suspicious activity to catch hacks earlier.

But at the same time, the most prolific hackers have become more sophisticated both in how they perform the hacking and then launder their stolen funds. While this is not a positive development, it shows that the measures adopted by the exchanges are effective enough to force hackers to adapt in the first place. And as we’ll show you, there are concrete steps that change and law enforcement can take to counter hackers’ new tactics.

Let’s examine some of the new tactics that stock market hackers have adopted by analyzing the activities of a high-profile cybercriminal organization.

How did the Lazarus Group get more advanced in 2019?

Lazarus Group is a notorious cybercrime organization affiliated with the North Korean government. Considered an advanced and persistent threat by cybersecurity experts, Lazarus is believed to be behind a series of cryptocurrency exchange attacks alongside Sony Pictures and 2017 WannaCry ransomware attacks in 2014. When we examine the hacking activities of the Lazarus Group in last year’s Crypto Crime Report, we can reveal that it is the organization we call “Beta Group”.

In 2019, the Lazarus Group made three major changes in its hacking and money laundering strategies:

1. More complex phishing tricks. The Lazarus Group has relied on social engineering to attack exchanges in the past, and often tricked employees into downloading malware that gave Lazarus access to users’ funds. But in a swap attack last year, Lazarus took this strategy one step further and implemented one of the most elaborate phishing plans we’ve seen to gain access to users’ funds.
2. Increased use of mixers and CoinJoin wallets. In 2019, hackers mostly sent funds stolen from exchanges via mixers, or more specifically Lazarus Group, CoinJoin wallets. Mixers obscure the path of funds by aggregating the cryptocurrency of multiple users and giving each one a minus 1-3% service fee equal to what they initially put from the pool. Everyone results in a “mix” of funds that everyone else has put in, making it difficult for inputs to link users’ transactions to an output. Many criminals use scramblers to hide the source of the illegal cryptocurrency before moving it to other services. CoinJoin wallets such as Wasabi Wallet (called the basic CoinJoin protocol),
3. Faster clearance. We’ve also seen hackers like Lazarus move their funds to exchanges and other services to liquidate in less than 2018. This trend could indicate that hackers in 2019 are improving their money laundering abilities or prioritizing faster access.

Let’s look at examples of how Lazarus uses these new tactics.

How did the Lazarus Group use a fake company as a phishing bait?

In March 2019, hackers breached the Singapore-based DragonEx exchange by buying various cryptocurrencies worth roughly $ 7 million, including Bitcoin, Ripple, and Litecoin. DragonEx responded quickly, announced that it was hacked on various social media platforms, and published a list of 20 wallet addresses to which their funds were transferred. This allowed other exchanges to mark these wallets and freeze the accounts associated with them, making it difficult for attackers to move funds. DragonEx also quickly contacted Chainalysis and asked for our assistance as well as legal authorities.

While the DragonEx hack was relatively small, the lengths the Lazarus Group took to infiltrate the exchange’s systems in a complex phishing attack was considerable. Lazarus has set up a fake company that claims to offer an automated cryptocurrency trading bot called Worldbit-bot, complete with a slick website and social media presence for fake employees.

Lazarus went so far as to develop a software product that looks like the trading bot they claim to be selling. The key difference, of course, was that the program contained malware that gave hackers access to anybody who downloaded it. The Lazarus Group hackers offered DragonEx employees a free trial version of the software and eventually persuaded someone to download it to a computer containing the private keys of their exchange wallets. From there, the hackers managed to deal with millions.

While most phishing attempts are based on an email or a small-scale website, Lazarus Group’s fictional Worldbit bot company is at another level of complexity. It reveals the time and resources at Lazarus’ disposal, as well as in-depth knowledge of the cryptocurrency ecosystem necessary to successfully imitate legitimate participants.

Increased mixer usage and faster withdrawals highlight changes in Lazarus’ money laundering strategy.

When we analyzed the 2018 post-hacking money laundering for last year’s Crypto Crime Report, we found that the Lazarus Group, like other leading hacking groups, did not use advanced money laundering techniques such as mixers to “clean up” and withdraw stolen cryptocurrency. Instead, they tended to park the funds in a wallet, wait 12 to 18 months, and suddenly move all the funds to the low KYC exchange when the coast appeared open.

We conclude that this was due primarily to Lazarus’ motivations being financial. While other leading hacking groups seem to be more concerned with causing chaos for targets and avoiding detection, Lazarus’s behavior showed that he was focused on converting stolen cryptocurrency into cash, even if it meant waiting for a long time and somehow moving them to an exchange. It is relatively easy to watch. While we don’t claim to know if Lazarus’ motivations changed in 2019, we do know that the way in which to move and cash out funds stolen in exchange hacks has changed. First, we see that a much higher percentage of their stolen funds are moved to the mixer.

98% of all funds Lazarus stole from exchanges in 2018, all moved to exchanges with low KYC requirements, and none went to the mixer or CoinJoin wallets. However, in 2019, 48% of funds stolen by Lazarus were moved to CoinJoin wallets, while 50% were not spent in the hackers’ original wallet.

We can see this below using the Chainalysis Reactor to compare the processing efficiency associated with a Lazarus hack in 2018 with one from 2019.

Above we see how Lazarus moved the stolen funds after one of the 2018 stock market hacks. Although it looks complicated due to the large number of processes, it is actually very simple. The funds leave the Kurban Borsasi wallet on the left, move between the two brokers wallets, and then are distributed across four different exchanges on the right. The many jumps in between represent the unspent exchange from wallet to stock market. Although the funds have a long path, they are relatively easy to follow.

The Reactor chart showing how Lazarus moved funds following the 2019 DragonEx hack is much more complex. In this case, stolen altcoins like Ethereum and Litecoin were moved to exchanges and traded for Bitcoin. They then shuffle Bitcoin withdrawn from exchanges between various local wallets, before moving it to the far-right Wasabi Wallet to mix funds through the CoinJoin protocol.

The Lazarus Group also moved the stolen funds to services where they could be liquidated much faster this year. In 2018, Lazarus took up to 500 days to move the funds from its first private wallet to a liquidation service, and it did not do so in less than 250 days. However, that changed drastically in 2019. Almost all of the stolen funds in both hacks attributed to Lazarus were moved to liquidation services in under 60 days, but some still remain unspent. Attacks attributed to other groups also followed this trend.

The increasing complexity and speed of Lazarus in laundering stolen cryptocurrency puts more pressure on intelligence agencies and exchanges to act faster when cybercriminals attack exchanges.

Exchanges need to continue to prioritize security

Exchanges have raised the bar on anti-hacking security in the past few years, but subsequent developments from groups like Lazarus show that they cannot count on their reputation. To stay one step ahead, they need to stay alert and continue to improve the improvements they have already made. We recommend that exchanges continue to install guard rails to ensure that suspicious transactions are flagged before they are completed, and take steps to prevent employees from downloading malware that could compromise their networks and give hackers access to the exchange’s private keys. In the event that exchanges are hacked, they must immediately report this to law enforcement and provide important information such as the addresses to which the stolen funds have been moved.

In addition to protecting them from being hacked, exchanges also have a responsibility to ensure that criminals do not use them to make money from other hacked exchanges. We recommend that exchanges handle large deposits – or small deposits with high volumes in a short time – from mixers or CoinJoin wallets with increasing suspicion. While there are legitimate uses for mixers, the data make it clear that they are increasingly being used by hackers to confuse the stolen funds before they can withdraw cash. Exchanges could possibly halt some of these cash payments and help law enforcement get back stolen funds by stopping suspicious transactions from mixers. Binance has already started doing this, and we think their model could be a useful example for other exchanges to follow.

Finally, we believe that increasing cross-border cooperation between law enforcement agencies can go a long way toward mitigating swap attacks. If financial intelligence units (FIUs) around the world can quickly share information from exchanges after they’ve been hacked, hackers can freeze funds before moving them to a mixer or low-KYC exchange.

The post System Security of Crypto Coins & The Hacking Incidents appeared first on PraeLegal.

The post Fleeing lockdown, Americans are flock to Mexico City – where the coronavirus is surging appeared first on PraeLegal.

The post He Calmed Gaza, Aided Israel’s Arab Ties and Preserved Hopes for Peace appeared first on PraeLegal.

The post Taiwan Vows to Stick to Covid-19 Limits appeared first on PraeLegal.

The post Rowing the Nile: A Soothing Respite in a Chaotic Metropolis appeared first on PraeLegal.

The post How Support for Legal Abortion Went Mainstream in Argentina appeared first on PraeLegal.

The post How Israel Became a World Leader in Vaccinating Against Covid-19 appeared first on PraeLegal.

Lending markets have experienced dramatic swings in activity over the past several years. In today’s environment, managing risks while taking a creative approach to pursuing opportunities has become an essential balancing act for those seeking to keep their business moving forward. Our independent Law and Consulting Firms have the deep market knowledge and decades of experience needed to provide effective and efficient leveraged finance solutions for complex transactions around the world.

An Experienced Global Finance Team

Our significant presence in these major financial centers and extensive deal flow enable us swiftly to advise our clients on shifts in market dynamics.

We integrate our bank finance practice with our debt capital markets expertise to offer clients seamless execution in bank/bond structures, whether within a single jurisdiction or in cross-border transactions. Our professionals provide market insight and innovative solutions in all aspects of leveraged finance, from negotiations on covenants, to complex subordination and inter-creditor issues, to structuring acquisition transactions that utilize multiple layers of financing. We also have extensive experience in tender offers, exchange offers, and consent solicitations for high-yield bonds.

Prae Legal represents leading financial institutions, mezzanine lenders, sponsors, issuers, and borrowers in a wide variety of acquisition finance and other leveraged finance transactions, including senior, subordinated, and mezzanine lending transactions; high-yield debt offerings; and bridge financings. In addition, we draw on the Firm’s global resources in tax, environmental, intellectual property, bankruptcy, and bank regulatory matters for the specialized expertise regularly required in many leveraged finance transactions.

Full-Service Legal Counsel for Leveraged Finance Transactions

Prae Legal Network’s Bank Finance  group comprises lawyers with leading expertise in the following areas:

• Asset-based loans
• Acquisition financings
• Bank regulatory matters
• Banking and Financial Regulation
• Bridge loans
• Capital Markets Offerings
• Consent solicitations
• Corporate Finance
• Convertible debt offerings
• Debtor-in-possession financings
• Exit financings
• High-yield debt offerings
• Investment Funds
• Inter-creditor negotiations
• Mezzanine financings
• Private Equity
• Preferred stock offerings
• Project Finance
• PPP – PFI Transactions
• Recapitalizations
• Secured and unsecured loans
• Security and Guarantees
• Securitisation and Factoring
• Structured Finance
• Tender offers/exchange offers

The post PraeLegal’s Banking and Financial Services Solution appeared first on PraeLegal.