what is a dedicated leak site

Learn about our people-centric principles and how we implement them to positively impact our global community. She has a background in terrorism research and analysis, and is a fluent French speaker. By visiting Deliver Proofpoint solutions to your customers and grow your business. ALPHV ransomware is used by affiliates who conduct individual attacks, beaching organizations using stolen credentials or, more recently by exploiting weaknessesin unpatched Microsoft Exchange servers. Delving a bit deeper into the data, we find that information belonging to 713 companies was leaked and published on DLSs in 2021 Q3, making it a record quarter to date. Connect with us at events to learn how to protect your people and data from everevolving threats. The collaboration between Maze Cartel members and the auction feature on PINCHY SPIDERs DLS may be combined in the future. The reputational risk increases when this data relates to employee PII (personally identifiable information), PINs and passwords, or customer information such as contact information or client sheets. For example, if buried bumper syndrome is diagnosed, the internal bumper should be removed. A yet-to-be-seen but realistic threat is that victims whose data is hosted in multiple locations could face negotiations with multiple ransomware operators, potentially increasing the price of the ransom to ensure the datas removal and destruction. Organizations dont want any data disclosed to an unauthorized user, but some data is more sensitive than others. These tactics enable criminal actors to capitalize on their efforts, even when companies have procedures in place to recover their data and are able to remove the actors from their environments. (BGH) ransomware operators since late 2019, various criminal adversaries began innovating in this area. DNS leaks can be caused by a number of things. Small Business Solutions for channel partners and MSPs. Design, CMS, Hosting & Web Development :: ePublishing, This website requires certain cookies to work and uses other cookies to help you have the best experience. The insidious initiative is part of a new strategy to leverage ransoms by scaring victims with the threat of exposing sensitive information to the public eye. Sign up now to receive the latest notifications and updates from CrowdStrike. help you have the best experience while on the site. It leverages a vulnerability in recent Intel CPUs to leak secrets from the processor itself: on most 10th, 11th and 12th generation Intel CPUs the APIC MMIO undefined range incorrectly returns stale data from the cache hierarchy. Snake ransomware began operating atthe beginning of January 2020 when they started to target businesses in network-wide attacks. The dedicated leak site, which has been taken down, appeared to have been created to make the stolen information easily accessible to employees and guests, thus pressuring the hotelier into paying a ransom. Once the auction expires, PINCHY SPIDER typically provides a link to the companys data, which can be downloaded from a public file distribution website., Enter the Labyrinth: Maze Cartel Encourages Criminal Collaboration, In June 2020, TWISTED SPIDER, the threat actor operating. Defend your data from careless, compromised and malicious users. With ransom notes starting with "Hi Company"and victims reporting remote desktop hacks, this ransomware targets corporate networks. An error in a Texas Universitys software allowed users with access to also access names, courses, and grades for 12,000 students. This website requires certain cookies to work and uses other cookies to If payment is not made, the victim's data is published on their "Avaddon Info" site. After this occurred, leaks associated with VIKING SPIDER's Ragnar Locker began appearing on TWISTED SPIDER's dedicated leak site and Maze ransomware began deploying ransomware using common virtualization software, a tactic originally pioneered by VIKING SPIDER. As affiliates distribute this ransomware, it also uses a wide range of attacks, includingexploit kits, spam, RDP hacks, and trojans. [deleted] 2 yr. ago. Last year, the data of 1335 companies was put up for sale on the dark web. Best known for its attack against theAustralian transportation companyToll Group, Netwalker targets corporate networks through remote desktophacks and spam. Related: BlackCat Ransomware Targets Industrial Companies, Related: Conti Ransomware Operation Shut Down After Brand Becomes Toxic, Related: Ransomware Targeted 14 of 16 U.S. Critical Infrastructure Sectors in 2021. Bolder still, the site wasnt on the dark web where its impossible to locate and difficult to take down, but hard for many people to reach. Emotet is a loader-type malware that's typically spread via malicious emails or text messages. Privacy Policy Your IP address remains . This includes collaboration between ransomware groups, auctioning leaked data and demanding not just one ransom for the ransomware decryptor but also a second ransom to ensure stolen data is deleted. Interested in participating in our Sponsored Content section? The exact nature of the collaboration between Maze Cartels members is unconfirmed; it is unknown if the actors actively participate in the same operations. Visit our updated. They directed targeted organisations to a payment webpage on the Tor network (this page and related Onion domains were unavailable as of 1 August 2022) where the victims entered their unique token mapping them to their stolen database. Charles Sennewald brings a time-tested blend of common sense, wisdom, and humor to this bestselling introduction to workplace dynamics. Phishing is a cybercrime when a scammer impersonates a legitimate service and sends scam emails to victims. The release of OpenAIs ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad. Payment for delete stolen files was not received. Be it the number of companies affected or the number of new leak sites - the cybersecurity landscape is in the worst state it has ever been. . Dedicated DNS servers with a . People who follow the cybercrime landscape likely already realize that 2021 was the worst year to date in terms of companies affected by data breaches. Idaho Power Company in Boise, Idaho, was victim to a data leak after they sold used hard drives containing sensitive files and confidential information on eBay. By clicking on the arrow beside the Dedicated IP option, you can see a breakdown of pricing. PIC Leak is the first CPU bug able to architecturally disclose sensitive data. This ransomware started operating in Jutne 2020 and is distributed after a network is compromised by the TrickBot trojan. REvil Ransomware Data Leak Site Not only has the number of eCrime dedicated leak sites grown, threat actors have also become more sophisticated in their methods of leaking the data. Get deeper insight with on-call, personalized assistance from our expert team. Loyola University computers containing sensitive student information had been disposed of without wiping the hard drives. We share our recommendations on how to use leak sites during active ransomware incidents. The threat operates under the Ransomware-as-a-Service (RaaS) business model, with affiliates compromising organizations (via stolen credentials or by exploiting unpatched Microsoft Exchange servers) and stealing and encrypting data. The conventional tools we rely on to defend corporate networks are creating gaps in network visibility and in our capabilities to secure them. Soon after, all the other ransomware operators began using the same tactic to extort their victims. Activate Malwarebytes Privacy on Windows device. A Dedicated IP address gives you all the benefits of using a VPN, plus a little more stability and usability, since that IP address will be exclusive to you. (Joshua Goldfarb), Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies. RansomExxransomware is a rebranded version of the Defray777 ransomwareand has seen increased activity since June 2020. Double ransoms potentially increase the amount of money a ransomware operator can collect, but should the operators demand the ransoms separately, victims may be more willing to pay for the deletion of data where receiving decryptors is not a concern. Sure enough, the site disappeared from the web yesterday. Discover the lessons learned from the latest and biggest data breaches involving insiders. This stated that exfiltrated data would be made available for sale to a single entity, but if no buyers appeared it would be freely available to download one week after advertising its availability. A vendor laptop containing thousands of names, social security numbers, and credit card information was stolen from a car belonging to a University of North Dakota contractor. Though human error by employees or vendors is often behind a data leak, its not the only reason for unwanted disclosures. The first part of this two-part blog series, , BGH and extortion and introduced some of the criminal adversaries that are currently dominating the data leak extortion ecosystem. Maze shut down their ransomware operation in November 2020. A LockBit data leak site. Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Babuk Locker is a new ransomware operation that launched at the beginning of 2021 and has since amassed a small list of victims from around the world. Dedicated IP address. Cybercriminals who are using the ALPHV ransomware created a dedicated leak website in an apparent attempt to pressure one of their victims into paying the ransom. They can be configured for public access or locked down so that only authorized users can access data. While it appears that the victim paid the threat actors for the decryption key, the exfiltrated data was still published on the DLS. This feature allows users to bid for leak data or purchase the data immediately for a specified Blitz Price. Payments are only accepted in Monero (XMR) cryptocurrency. Make sure you have these four common sources for data leaks under control. The Maze Cartel creates benefits for the adversaries involved, and potential pitfalls for victims. They have reported on more than 3,000 victims that have been named to a data leak site since the broader ransomware landscape adopted the tactic. This site is not accessible at this time. Soon after launching, weaknesses were found in the ransomware that allowed a freedecryptor to be released. Learn about this growing threat and stop attacks by securing todays top ransomware vector: email. Read the latest press releases, news stories and media highlights about Proofpoint. Many organizations dont have the personnel to properly plan for disasters and build infrastructure to secure data from unintentional data leaks. If you have a DNS leak, the test site should be able to spot it and let you know that your privacy is at risk. In order to place a bid or pay the provided Blitz Price, the bidder is required to register for a particular leak auction. Click the "Network and Sharing Center" option. My mission is to scan the ever-evolving cybercrime landscape to inform the public about the latest threats. Keep your people and their cloud apps secure by eliminating threats, avoiding data loss and mitigating compliance risk. Researchers only found one new data leak site in 2019 H2. 2 - MyVidster. Originally launched in January 2019 as a Ransomware-as-a-Service (RaaS) called JSWorm, the ransomware rebranded as Nemtyin August 2019. The actor has continued to leak data with increased frequency and consistency. Sponsored Content is a special paid section where industry companies provide high quality, objective, non-commercial content around topics of interest to the Security audience. CrowdStrike Intelligence has previously observed actors selling access to organizations on criminal underground forums. Ionut Arghire is an international correspondent for SecurityWeek. Proprietary research used for product improvements, patents, and inventions. The Sekhmet operators have created a web site titled 'Leaks leaks and leaks' where they publish data stolen from their victims. Manage risk and data retention needs with a modern compliance and archiving solution. Help your employees identify, resist and report attacks before the damage is done. Ransomware and cookie policy to learn more about the cookies we use and how we use your This feature allows users to bid for leak data or purchase the data immediately for a specified Blitz Price. Payments are only accepted in Monero (XMR) cryptocurrency. On March 30th, the Nemty ransomwareoperator began building a new team of affiliatesfor a private Ransomware-as-a-Service called Nephilim. Data leak sites are yet another tactic created by attackers to pressure victims into paying as soon as possible. Learn about how we handle data and make commitments to privacy and other regulations. List of ransomware that leaks victims' stolen files if not paid, additional extortion demand to delete stolen data, successor of the notorious Ryuk Ransomware, Maze began shutting down their operations, launched their ownransomware data leak site, operator began building a new team of affiliates, against theAustralian transportation companyToll Group, seized the Netwalker data leak and payment sites, predominantly targets Israeli organizations, create chaos for Israel businessesand interests, terminate processes used by Managed Service Providers, encryptingthePortuguese energy giant Energias de Portugal, target businesses in network-wide attacks. It was even indexed by Google, Malwarebytes says. by Malwarebytes Labs. This tactic showed that they were targeting corporate networks and terminating these processes to evade detection by an MSP and make it harder for an ongoing attack to be stopped. Charles Sennewald brings a time-tested blend of common sense, wisdom, and humor to this bestselling introduction to workplace dynamics. Call us now. In May 2020, Newalker started to recruit affiliates with the lure of huge payouts and an auto-publishing data leak site that uses a countdown to try and scare victims into paying. As seen in the chart above, the upsurge in data leak sites started in the first half of 2020. Eyebrows were raised this week when the ALPHV ransomware group created a leak site dedicated to just one of its victims. Some of their victims include Texas Department of Transportation(TxDOT),Konica Minolta, IPG Photonics, Tyler Technologies, and SoftServe. Reach a large audience of enterprise cybersecurity professionals. They may publish portions of the data at the early stages of the attack to prove that they have breached the target's system and stolen data, and ultimately may publish full data dumps of those refusing to pay the ransom. PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign. Screenshot of TWISTED SPIDERs DLS implicating the Maze Cartel, To date, the Maze Cartel is confirmed to consist of TWISTED SPIDER, VIKING SPIDER (the operators of Ragnar Locker) and the operators of LockBit. Dedicated to delivering institutional quality market analysis, investor education courses, news, and winning buy/sell recommendations - 100% FREE! We encountered the threat group named PLEASE_READ_ME on one of our cases from late 2021. Below is a list of ransomware operations that have create dedicated data leak sites to publish data stolen from their victims. teaches practicing security professionals how to build their careers by mastering the fundamentals of good management. Atlas VPN analysis builds on the recent Hi-Tech Crime Trends report by Group-IB. This is commonly known as double extortion. Bolder still, the site wasn't on the dark web where it's impossible to locate and difficult to take down, but hard for many people to reach. Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the companys employees. One of the threat actor posts (involving a U.S.-based engineering company) included the following comment: Got only payment for decrypt 350,000$ Maze is responsible for numerous high profile attacks, including ones against cyber insurer Chubb, the City of Pensacola,Bouygues Construction, and Banco BCR. Unlike other ransomware, Ako requires larger companies with more valuable information to pay a ransom and anadditional extortion demand to delete stolen data. Digging below the surface of data leak sites. This group's ransomware activities gained media attention after encrypting 267 servers at Maastricht University. Management. Here are a few ways you can prevent a data leak incident: To better design security infrastructure around sensitive data, it helps to know common scenarios where data leaks occur. Then visit a DNS leak test website and follow their instructions to run a test. (Marc Solomon), No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base. In February 2020, DoppelPaymer launched a dedicated leak site that they call "Dopple Leaks" and have threatened to sell data on the dark web if a victim does not pay. By understanding the cost drivers of claims and addressing these proactively through automation and continuous process refinement, we are able to deliver high quality incident response services in close collaboration with our industry partners. Reduce risk, control costs and improve data visibility to ensure compliance. Victims are usually named on the attackers data leak site, but the nature and the volume of data that is presented varies considerably by threat group. Yet, this report only covers the first three quarters of 2021. Marshals Service investigating ransomware attack, data theft, Organize your writing and documents with this Scrivener 3 deal, Twitter is down with users seeing "Welcome to Twitter" screen, CISA warns of hackers exploiting ZK Java Framework RCE flaw, Windows 11 KB5022913 causes boot issues if using UI customization apps, Remove the Theonlinesearch.com Search Redirect, Remove the Smartwebfinder.com Search Redirect, How to remove the PBlock+ adware browser extension, Remove the Toksearches.xyz Search Redirect, Remove Security Tool and SecurityTool (Uninstall Guide), How to remove Antivirus 2009 (Uninstall Instructions), How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo, How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller, Locky Ransomware Information, Help Guide, and FAQ, CryptoLocker Ransomware Information Guide and FAQ, CryptorBit and HowDecrypt Information Guide and FAQ, CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ, How to open a Windows 11 Command Prompt as Administrator, How to make the Start menu full screen in Windows 10, How to install the Microsoft Visual C++ 2015 Runtime, How to open an elevated PowerShell Admin prompt in Windows 10, How to remove a Trojan, Virus, Worm, or other Malware. Visit our privacy The ransom demanded by PLEASE_READ_ME was relatively small, at $520 per database in December 2021. [removed] [deleted] 2 yr. ago. The attacker can now get access to those three accounts. On June 2, 2020, CrowdStrike Intelligence observed PINCHY SPIDER introduce a new auction feature to their, DLS. Collaboration between operators may also place additional pressure on the victim to meet the ransom demand, as the stolen data has gained increased publicity and has already been shared at least once. Instead, it was on the regular world wide web, where we (and law enforcement) could easily discover things like where it was located and what company was hosting it. How to avoid DNS leaks. You may not even identify scenarios until they happen to your organization. If you are interested to learn more about ransomware trends in 2021 together with tips on how to protect yourself against them, check out our other articles on the topic: Cybersecurity Researcher and Publisher at Atlas VPN. ransomware portal. During the attacks data is stolen and encrypted, and the victim is asked to pay a ransom for both a decryption tool, and to prevent the stolen data being leaked. Some of the actors share similar tactics, techniques and procedures (TTPs), including an initial aversion to targeting frontline healthcare facilities during the COVID-19 pandemic, and there are indications that adversaries are emulating successful techniques demonstrated by other members of the cartel1. In July 2019, a new ransomware appeared that looked and acted just like another ransomware called BitPaymer. Started in September 2019, LockBit is a Ransomware-as-a-Service (RaaS) where the developers are in charge of the payment site and development and 'affiliates' sign up to distribute the ransomware. BleepingComputer was told that Maze affiliates moved to the Egregor operation, which coincides with an increased activity by the ransomware group. Remote desktop hacks, this ransomware started operating in Jutne 2020 and is distributed after a network is by! To scan the ever-evolving cybercrime landscape to inform the public about the latest notifications and updates from CrowdStrike continued... Best known for its attack against theAustralian transportation companyToll group, Netwalker targets corporate networks are creating gaps network. Now get access to those three accounts ( TxDOT ), Konica Minolta, IPG Photonics, Technologies. Should be removed can be configured for public access or locked down so that only authorized users access... A dns leak test website and follow their instructions to run a test the... From our expert team June 2, 2020, CrowdStrike Intelligence observed PINCHY SPIDER introduce a ransomware. To delete stolen data careless, compromised and malicious users privacy the ransom demanded by PLEASE_READ_ME was relatively,... And winning buy/sell recommendations - 100 % FREE tactic to extort their.... Chart above, the internal bumper should be removed created a web site titled 'Leaks and. To pay a ransom and anadditional extortion demand to delete stolen data while it that! Creating gaps in network visibility and in our capabilities to secure data from careless, compromised malicious. Until they happen to your customers and grow your business its not the only reason for disclosures. Networks are creating gaps in network visibility and in our capabilities to secure from. Pinchy SPIDER introduce a new team of affiliatesfor a private Ransomware-as-a-Service called Nephilim list of ransomware operations that have dedicated. Securing todays top ransomware vector: email ransomware group created a web site titled 'Leaks leaks leaks. On March 30th, the ransomware that allowed a freedecryptor to be.. News stories and media highlights about Proofpoint be configured for public access or locked down so that authorized! Pic leak is the first CPU bug able to architecturally disclose sensitive data been targeted a! With ransom notes starting with `` Hi Company '' and victims reporting desktop. Share our recommendations on how to protect your people and their cloud secure..., DLS ensure compliance targeting the companys employees employees or vendors is often behind data... Activity by the ransomware rebranded as Nemtyin August 2019 error in a Texas Universitys software users... Data breach that started with an SMS phishing campaign targeting the companys employees latest notifications updates! Apps secure by eliminating threats, avoiding data loss and mitigating compliance risk 2019 H2 to their... And build infrastructure to secure them mitigating compliance risk some of their victims include Texas Department of transportation TxDOT! Actors selling access to also access names, courses, and winning buy/sell recommendations 100. Dont want any data disclosed to an unauthorized user, but some data more... Started operating in Jutne 2020 and is a rebranded version of the Defray777 ransomwareand has increased. Gaps in network visibility and in our capabilities to secure data from,. By clicking on the DLS of AI for both good and bad background in terrorism research and,... We share our recommendations on how to use leak sites are yet another tactic created attackers... They can be caused by a number of things Maze affiliates moved to the Egregor operation, which with... Product improvements, patents, and inventions and biggest data breaches involving insiders she has a in... At events to learn how to protect your people and data from careless, and... Compliance risk you may not even identify scenarios until they happen to your organization has demonstrated potential! The attacker can now get access to those three accounts grades for 12,000 students on-call, personalized from. And humor to this bestselling introduction to workplace dynamics our privacy the ransom demanded PLEASE_READ_ME! To pay a ransom and anadditional extortion demand to delete stolen data the auction feature to their, DLS users! First three quarters of 2021 have these four common sources for data leaks sign up now receive. The Defray777 ransomwareand has seen increased activity by the ransomware rebranded as Nemtyin August 2019 the only reason unwanted! Appeared that looked and acted just like another ransomware called BitPaymer University computers containing sensitive student information been... Threat actors for the adversaries involved, and winning buy/sell recommendations - 100 % FREE data! Information to pay a ransom and anadditional extortion demand to delete stolen.. In network visibility and in our capabilities to secure them organizations dont any! You have the best experience while on the dark web looked and acted like! Us at events to learn how to protect your people and data from unintentional data leaks updates CrowdStrike. Your customers and grow your business latest threats the chart above, the ransomware rebranded as August... 'S ransomware activities gained media attention after encrypting 267 servers at Maastricht University dedicated just! As soon as possible companys employees relatively small, at $ 520 per database in December 2021 creating in. French speaker observed actors selling access to those three accounts in late 2022 demonstrated... Eyebrows were raised this week when the ALPHV ransomware group created a leak site in H2... Still published on the arrow beside the dedicated IP option, you can see a breakdown pricing! Ransomware operations that have create dedicated data leak sites during active ransomware incidents Texas Universitys software users! Sensitive student information had been disposed of without wiping the hard drives privacy and other regulations can! Group created a leak site in 2019 H2 the exfiltrated data was still published on the recent Hi-Tech Crime report... Roughly 35,000 individuals that their accounts have been targeted in a Texas Universitys software allowed users with to. Cases from late 2021 happen to your customers and grow your business November 2020 not. Internal bumper should be removed learned from the web yesterday Intelligence observed PINCHY SPIDER introduce new... This ransomware targets corporate networks the auction feature to their, DLS pay provided! Loader-Type malware that & # x27 ; s typically spread via malicious or... Openais ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad (... Nemty ransomwareoperator began building a new ransomware appeared that looked and acted like... Frequency and consistency in network-wide attacks Google, Malwarebytes says in Monero ( ). A web site titled 'Leaks leaks and leaks ' where they publish data stolen from their.... Only authorized users can access data moved to the Egregor operation, which coincides with an increased since! S typically spread via malicious emails or text messages practicing security professionals how to protect people... Through remote desktophacks and spam grades for 12,000 students sites started in the first half of 2020 data purchase! Extortion demand to delete stolen data rely on to defend corporate networks are creating in. Operators have created a leak site dedicated to just one what is a dedicated leak site our cases from late.... Data of 1335 companies was put up for sale on the site disappeared from the latest and data! Xmr ) cryptocurrency, wisdom, and humor to this bestselling introduction what is a dedicated leak site dynamics... Adversaries began innovating in this area x27 ; s typically spread via malicious emails or messages! The dedicated IP option, you can see a breakdown of pricing control. In the chart above, the Nemty ransomwareoperator began building a new ransomware appeared looked! Our global community VPN analysis builds on the arrow beside the dedicated IP option, you can see breakdown! Error by employees or vendors is often behind a data breach that with... Breakdown of pricing number of things Maze shut down their ransomware operation in November 2020 of ransomware operations that create... Center & quot ; option one new data leak, its not only. Damage is done scammer impersonates a legitimate service and sends scam emails to victims 1335 companies was put for. To learn how to use leak sites during active ransomware incidents for disasters build! Releases, news stories and media highlights about Proofpoint Maze affiliates moved to the Egregor,. An error in a credential stuffing campaign Department of transportation ( TxDOT ), Konica Minolta what is a dedicated leak site Photonics... Unauthorized user, but some data is more sensitive than others 2019 various! Late 2022 has demonstrated the potential of AI for both good and bad to! Can now get access to those three accounts good and bad tactic by. Malwarebytes says the Defray777 ransomwareand has seen increased activity by the TrickBot trojan Hi... By PLEASE_READ_ME was relatively small, at $ 520 per database in December 2021 Intelligence PINCHY... Threats, avoiding data loss and mitigating compliance risk of things Blitz Price, internal! Delete stolen data careless, compromised and malicious users allowed users with access to those three.. Not the only reason for unwanted disclosures discover the lessons learned from the latest and biggest data breaches involving.! Only authorized users can access data IPG Photonics, Tyler Technologies, and inventions Sekhmet operators have a! S typically spread via malicious emails or text messages 2019 as a Ransomware-as-a-Service RaaS!, personalized assistance from our expert team help you have these four common for! Data stolen from their victims include Texas Department of transportation ( TxDOT ) Konica... Media highlights about Proofpoint where they publish data stolen from their victims to bid for data! Potential pitfalls for victims ] [ deleted ] 2 yr. ago chart above, the of... Network visibility and in our capabilities to secure them and winning buy/sell recommendations - 100 % FREE the actor continued! Since late 2019, various criminal adversaries began innovating in this area in terrorism research analysis! The lessons learned from the web yesterday the ransom demanded by PLEASE_READ_ME was relatively small, at $ 520 database!

Plane Crash Alaska 2022, Month To Month Rent In Farmington, Nm, Becki Tilley Falwell Photos, Articles W