BIS Collaborates with Singapore’s MAS, Bringing CBDC Pilot to a Close

Akira ransomware, responsible for stealing $42 million from over 250 organizations across North America, Europe and Australia in just a year, is now targeting businesses in Singapore. In response, Singaporean authorities have issued a joint advisory warning local businesses about the increasing threat posed by a variant of this ransomware.Photo by Mike Enerio on UnsplashAlert follows complaintsThe alert follows multiple complaints from victims, prompting agencies like the Cyber Security Agency of Singapore (CSA), the Singapore Police Force (SPF) and the Personal Data Protection Commission (PDPC) to take action. These agencies emphasize the urgency of recognizing and combating this threat. How Akira operatesAkira affiliates employ various techniques to infiltrate a victim's network. These include exploiting known vulernabilities. For example, that could mean the targeting of services like Cisco virtual private networks (VPNs) that have been configured without multi-factor authentication (MFA). Another approach that the ransomware incorporates is attacking external-facing services such as the Remote Desktop Protocol (RDP) via brute force. Social engineering is another tool within its repertoire. This involves tricking victims into downloading malicious software or entering credentials on phishing websites. There is a marketplace for compromised credentials in the dark web. Akira also relies on such data, acquiring it from access brokers who sell network access.  Once inside a network, Akira affiliates often create new domain accounts to maintain persistent access, even after reboots. They use numerous tools to steal user credentials, escalate privileges and spread throughout the network. Detection and prevention measuresThe Singaporean advisory outlines several strategies for detecting, deterring and neutralizing Akira attacks. Authorities strongly advise against paying ransoms, on the basis that doing so does not guarantee data recovery or prevent future attacks. Authorities also warn that paying ransoms can encourage further attacks. The FBI has noted that Akira operators do not contact victims. Instead, they expect victims to initiate contact. Payment in BitcoinThe advisory outlines how Bitcoin is implicated in the ransomware scam. It states:”Ransom payments are requested in Bitcoin, which are directed to cryptocurrency wallet addresses specified by the affiliates. The TOR site (.onion) where victims contact the affiliates, contains stolen information and a list of the affected organisations.” It’s not the first time that Singaporean authorities have issued warnings that have implicated Bitcoin and crypto. In January, the CSA and SPF, in a joint advisory, suggested that people should use hardware wallets in an effort to guard against crypto-related malware and phishing attacks. A number of weeks prior to that, Singapore’s former Prime Minister, Lee Hsien Loong, took to Facebook to issue a warning with regard to a crypto scam that involved the use of deceptive content generated using artificial intelligence (AI). Mitigation techniquesBusinesses are being urged by the authorities to adopt best practices to mitigate the Akira ransomware threat. They suggest the implementation of a recovery plan alongside the use of multi-factor authentication (MFA) in order to secure data and the access to that data.  They also suggest filtering network traffic as it helps in identifying and blocking malicious activities. Meanwhile, disabling unused ports and hyperlinks curbs the risk further as it reduces the attack surface. Lastly, the authorities suggested the use of system-wide encryption to protect data even if it is accessed by unauthorized entities.

Overseas Crypto Holdings Declared to Korean Tax Agency Amount to $98BIn a recent press release from the South Korean National Tax Service (NTS), it was revealed that this year, a record 5,419 Koreans declared overseas financial assets amounting to KRW 186.4 trillion. This is a notable jump from the previous year, marking a 38.1% rise in the number of declarants and an impressive 191.3% increase in the declared amount.Photo by Traxer on UnsplashRecord-breaking declarationsThese are the most significant figures reported since the 2011 inception of the overseas financial account reporting system, which requires Korean individuals and entities to disclose their foreign financial holdings, like savings, stocks, collective investment schemes, and derivatives, if their balance exceeds KRW 500 million.The NTS attributed the record-breaking figures to foreign crypto accounts, a new addition to this year’s overseas account declaration.Crypto’s dominanceVirtual assets comprised a staggering 70.2% of the total declared amount, overshadowing all other assets. 1,432 individuals and corporate entities reported crypto holdings amounting to KRW 130.8 trillion (approximately $98 billion).Decline in non-virtual assetsFor non-virtual asset accounts, including deposits, savings, and stocks, the reported figure stood at KRW 55.6 trillion, marking a year-on-year drop of KRW 8.4 trillion, or a 13.1% decline.Call for complianceIn the future, the NTS plans to leverage data shared between countries to rigorously check for potential non-compliance in reporting overseas financial accounts. Those suspected of omissions can expect strict actions, including fines, criminal charges, public name disclosure, and the collection of related taxes.After the reporting deadline, filers may be eligible for a penalty reduction of up to 90%. Importantly, tax agencies worldwide, including the NTS, are gearing up to share information like cryptocurrency transaction details under the Crypto Asset Reporting Framework. In light of this, the NTS strongly encourages those who haven’t yet reported but are obligated to to promptly declare their overseas virtual asset accounts.

India’s HPCL Embraces Blockchain Tech to Streamline Purchase OrdersHindustan Petroleum Corporation Limited (HPCL) has forged a partnership with Zupple Labs, an Indian Web3 startup, to upgrade its purchase order processes through blockchain.Photo by Zbynek Burival on UnsplashTamper-proof documentationAccording to local media publication Business Today, the collaboration leverages blockchain technology to issue tamper-proof digital purchase orders via LegitDoc, ensuring instant verification on the NEAR blockchain. The move is a significant step toward enhancing transparency and efficiency in the purchase order system, addressing long-standing challenges in the industry.Notably, HPCL has awarded purchase orders worth $52 billion in the past five years, making these orders economically significant. Until now, automating purchase order verification for third-party requests outside of HPCL proved to be particularly challenging, resulting in substantial manual labor to process external verification requests.With the implementation of LegitDoc, historically fraud-prone purchase orders can be seamlessly issued to the relevant stakeholders. This breakthrough empowers participants to verify the authenticity of these orders with a simple click, reducing the risk of forgery and expediting the verification process.HPCL’s use of blockchain technology in partnership with Zupple Labs serves multiple purposes. It aims to combat purchase order forgery, simplify vendor access to trade finance through collateralization, and provide evidence of turnover, ultimately facilitating participation in public procurement processes. The facility will soon be accessible to both the public and vendors, with the launch set for October.Neil Martis, the founder of LegitDoc, expressed his enthusiasm about HPCL’s adoption of their technology. He noted:“It’s exciting to see an oil conglomerate such as HPCL use our technology LegitDoc, to secure billions of dollars’ worth of purchase orders. This serves as a testament to the confidence that businesses and governments have placed in our blockchain platform over the years in protecting important documents.”Utilizing two blockchainsThe approach taken in this instance relies on the use of two parallel blockchains which act as settlement layers: the NEAR public blockchain and permissioned private blockchain Hyperledger Fabric. As of mid-October, 3,000 purchase orders had been issued using blockchain.HPCL’s move to digitize and secure its purchase order system not only benefits the corporation but also has industry-wide implications. By promoting digital automation and trust, it sets a precedent for transparency and efficiency in the oil and gas sector. This adoption of blockchain technology aligns with a global trend of enhancing digital trust and streamlining operations across various sectors.Further application of blockchain techIt’s worth noting that this isn’t the first instance of Zupple Labs’ blockchain technology-based solutions being employed by the government in India. LegitDoc has previously been adopted by the administration of Gadchiroli, Maharashtra, for issuing tribal caste certificates in 2022, in that instance by way of the Polygon blockchain.Moreover, the technology played a pivotal role in issuing COVID-19 vaccine certificates in Maharashtra in 2021, while over 100,000 degree certificates were issued in 2022. These instances underscore the versatility and growing acceptance of blockchain technology in modern governance and business processes.