What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In May 2020, researchers found an Iran-linked hacking group’s server exposed to the internet because of a basic security misconfiguration. It remained accessible for three days and contained roughly 40 GB of operational material, including nearly five hours of training videos that showed operators accessing victims’ personal accounts and copying their data. SecurityWeek reported IBM X-Force IRIS’s findings on July 16, 2020.
How researchers found the exposed files
IBM X-Force Incident Response Intelligence Services (IRIS) researchers discovered the server in May 2020. According to SecurityWeek’s account, a basic security misconfiguration left it publicly accessible for three days. The server hosted multiple domains used by the group and held roughly 40 GB of operational material.
This was an exposure caused by the hackers’ own server configuration, not a breach of IBM or a cloud provider. The 40 GB figure describes the material on that server; it is not a measurement of data stolen from victims.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What the training videos revealed
The nearly five hours of recordings documented operators signing in to personal accounts and gathering contacts, images, and files stored in cloud services. SecurityWeek reported that the videos showed successful access to personal accounts belonging to a U.S. Navy member and an officer in Greece’s Hellenic Navy. IBM said it found no evidence in the material it reviewed that either person’s professional network credentials had been compromised, and no professional information appeared in that material.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
The recordings also showed attempts against U.S. State Department officials and an Iranian-American philanthropist that apparently failed. The Hacker News’ July 17, 2020 account adds that operators used credentials obtained through spear-phishing, removed suspicious-login notifications, accessed Google Takeout, and tried victim credentials against Zimbra. That report says the sessions were captured with Bandicam. These are details reported about the recordings, not a claim that the videos or victims’ account data remain publicly available.
Why the videos mattered
Security reporting often describes attacks through the victim’s experience or the data left behind. These recordings offered a rare view of the operators’ workflow: how they used stolen credentials, navigated personal accounts, and collected information. The videos also illustrated that a successful login could expose private photos, contacts, and cloud files even when professional network access was not demonstrated.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
The Hacker News reported that operators skipped accounts requiring multi-factor authentication (MFA). That makes MFA a practical defense against password theft, but the incident does not establish it as a complete defense against every form of account compromise.
Choosing MFA for personal accounts
- Authenticator-app codes: A separate app generates sign-in codes, adding a second step beyond the password. They are generally more resistant to password-only attacks, but a phishing site can still trick a user into entering a current code.
- Hardware security keys: A physical key can provide phishing-resistant sign-in when supported by the account service and configured correctly. Check device compatibility and recovery options before relying on one.
- Other offered methods: Some services support additional verification methods. Turn on the strongest option the service supports and keep recovery details current so a lost phone or key does not lock you out.
Which group was responsible?
SecurityWeek identified the group as ITG18 and listed Charming Kitten, Phosphorous, APT35, and NewsBeef as tracking names. A later SecurityWeek report also associated ITG18 with Charming Kitten, Phosphorus, TA435, and other names. These labels come from different threat-intelligence naming conventions, so they should not be treated as a single universally standardized identity. Coverage characterizes the group as Iran-linked; that attribution is not an independently adjudicated finding here.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
Keep the later data figures separate
A 2021 SecurityWeek report on other ITG18 activity cited substantially larger figures. They describe different targets, periods, and data scopes—not the contents of the server exposed in 2020.
| Figure | What it describes |
|---|---|
| Roughly 40 GB | Material on the misconfigured server found in May 2020, as reported by SecurityWeek from IBM X-Force IRIS findings. |
| Roughly 120 GB from approximately 20 individuals | Later activity involving Iranian reformist-aligned targets, reported by SecurityWeek in 2021 from IBM X-Force findings. |
| Almost 2 terabytes of compressed exfiltrated data | Data IBM X-Force said it had observed on publicly accessible ITG18 servers since 2018, as reported by SecurityWeek in 2021. This is not the size of the 2020 exposed server’s contents. |
IBM’s assessment, quoted by SecurityWeek in 2020, was: “IBM X-Force IRIS considers ITG18 a determined threat group with a significant investment in its operations.”
Quick Recap
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
