Data Leak at Dutch Police Caused by Infostealer Malware

By Netvora Tech News

A security company, Hudson Rock, has revealed that a data leak at the Dutch police, which affected the personal data of 62,000 employees, was caused by an infostealer malware. The malware infected a police officer's computer, allowing hackers to steal VPN login credentials and police.nl session cookies. The infostealer malware, designed to steal login credentials and other data from infected systems, was used in the attack on the police. The hackers were able to bypass authentication and gain access to the network by using the stolen session cookies in a "pass-the-cookie" attack. According to Hudson Rock, the malware was used by a group called Laundry Bear, which was identified by the Netherlands' General Intelligence and Security Service (AIVD) and Military Intelligence Service (MIVD). The group is believed to be sponsored by a state actor. The security company notes that the incident highlights a growing trend of state-sponsored actors using infostealers in high-impact attacks. Standard security measures such as multifactor authentication (MFA), short-lived session tokens, and employee training could have prevented the incident. In response to the incident, the National Cyber Security Centre (NCSC) has advised organizations to take steps to protect against similar attacks, including managing session cookies, using phishing-resistant MFA, implementing endpoint detection and response, and investing in employee awareness and training programs. These recommendations are also echoed by Hudson Rock, which has identified the importance of educating employees on cybersecurity best practices to prevent such incidents in the future.

The infostealer malware was used to steal VPN login credentials and police.nl session cookies.
The hackers used the stolen session cookies in a "pass-the-cookie" attack to bypass authentication and gain access to the network.
The incident highlights a growing trend of state-sponsored actors using infostealers in high-impact attacks.
Standard security measures such as MFA, short-lived session tokens, and employee training could have prevented the incident.