# articles

feed_id: https://krebsonsecurity.com/?p=69445
title: FBI: Spike in Hacked Police Emails, Fake Subpoenas
uri: FBI-Spike-in-Hacked-Police-Emails-Fake-Subpoenas
url: https://krebsonsecurity.com/2024/11/fbi-spike-in-hacked-police-emails-fake-subpoenas/
content:
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based technology companies.</p>
<p><img decoding="async" class="aligncenter  wp-image-59128" src="media/b7372c46.legalrequest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png" alt="" width="750" height="623" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-782x650.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>In <a href="media/2780b4d6.241104.pdf" data-original-source="https://www.ic3.gov/CSA/2024/241104.pdf" target="_blank" rel="noopener">an alert</a> (PDF) published this week, the FBI said it has seen un uptick in postings on criminal forums regarding the process of emergency data requests (EDRs) and the sale of email credentials stolen from police departments and government agencies.</p>
<p>&#8220;Cybercriminals are likely gaining access to compromised US and foreign government email addresses and using them to conduct fraudulent emergency data requests to US based companies, exposing the personal information of customers to further use for criminal purposes,&#8221; the FBI warned.</p>
<p>In the United States, when federal, state or local law enforcement agencies wish to obtain information about an account at a technology provider &#8212; such as the account&#8217;s email address, or what Internet addresses a specific cell phone account has used in the past &#8212; they must submit an official court-ordered warrant or subpoena.</p>
<p>Virtually all major technology companies serving large numbers of users online have departments that routinely review and process such requests, which are typically granted (eventually, and at least in part) as long as the proper documents are provided and the request appears to come from an email address connected to an actual police department domain name.</p>
<p>In some cases, a cybercriminal will offer to forge a court-approved subpoena and send that through a hacked police or government email account. But increasingly, thieves are relying on fake EDRs, which allow investigators to attest that people will be bodily harmed or killed unless a request for account data is granted expeditiously.</p>
<p>The trouble is, these EDRs largely bypass any official review and do not require the requester to supply any court-approved documents. Also, it is difficult for a company that receives one of these EDRs to immediately determine whether it is legitimate.</p>
<p>In this scenario, the receiving company finds itself caught between two unsavory outcomes: Failing to immediately comply with an EDR — and potentially having someone’s blood on their hands — or possibly leaking a customer record to the wrong person.</p>
<p>Perhaps unsurprisingly, compliance with such requests tends to be extremely high. For example, in its most recent <a href="media/2b31a43e.US-Transparency-Report-2H-2023.pdf" data-original-source="https://www.verizon.com/about/sites/default/files/US-Transparency-Report-2H-2023.pdf" target="_blank" rel="noopener">transparency report</a> (PDF) <strong>Verizon</strong> said it received more than 127,000 law enforcement demands for customer data in the second half of 2023 &#8212; including more than 36,000 EDRs &#8212; and that the company provided records in response to approximately 90 percent of requests.</p>
<p>One English-speaking cybercriminal who goes by the nicknames &#8220;<strong>Pwnstar</strong>&#8221; and &#8220;<strong>Pwnipotent</strong>&#8221; has been selling fake EDR services on both Russian-language and English cybercrime forums. Their prices range from $1,000 to $3,000 per successful request, and they claim to control &#8220;gov emails from over 25 countries,&#8221; including Argentina, Bangladesh, Brazil, Bolivia, Dominican Republic, Hungary, India, Kenya, Jordan, Lebanon, Laos, Malaysia, Mexico, Morocco, Nigeria, Oman, Pakistan, Panama, Paraguay, Peru, Philippines, Tunisia, Turkey, United Arab Emirates (UAE), and Vietnam.</p>
<p>&#8220;I cannot 100% guarantee every order will go through,&#8221; Pwnstar explained. &#8220;This is social engineering at the highest level and there will be failed attempts at times. Don&#8217;t be discouraged. You can use escrow and I give full refund back if EDR doesn&#8217;t go through and you don&#8217;t receive your information.&#8221;<span id="more-69445"></span></p>
<div id="attachment_69453" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69453" decoding="async" loading="lazy" class=" wp-image-69453" src="media/df67e25e.pwnstar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/pwnstar.png" alt="" width="750" height="644" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/pwnstar.png 1001w, https://krebsonsecurity.com/wp-content/uploads/2024/11/pwnstar-768x660.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/pwnstar-782x672.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69453" class="wp-caption-text">An ad from Pwnstar for fake EDR services.</p></div>
<p>A review of EDR vendors across many cybercrime forums shows that some fake EDR vendors sell the ability to send phony police requests to specific social media platforms, including forged court-approved documents. Others simply sell access to hacked government or police email accounts, and leave it up to the buyer to forge any needed documents.</p>
<p>&#8220;When you get account, it&#8217;s yours, your account, your liability,&#8221; reads an ad in October on <strong>BreachForums</strong>. &#8220;Unlimited Emergency Data Requests. Once Paid, the Logins are completely Yours. Reset as you please. You would need to Forge Documents to Successfully Emergency Data Request.&#8221;</p>
<p>Still other fake EDR service vendors claim to sell hacked or fraudulently created accounts on <strong>Kodex</strong>, a startup that aims to help tech companies do a better job screening out phony law enforcement data requests. Kodex is <a href="https://krebsonsecurity.com/2022/04/fighting-fake-edrs-with-credit-ratings-for-police/" target="_blank" rel="noopener">trying to tackle the problem of fake EDRs</a> by working directly with the data providers to pool information about police or government officials submitting these requests, with an eye toward making it easier for everyone to spot an unauthorized EDR.</p>
<p>If police or government officials wish to request records regarding Coinbase customers, for example, they must first register an account on Kodexglobal.com. Kodex&#8217;s systems then assign that requestor a score or credit rating, wherein officials who have a long history of sending valid legal requests will have a higher rating than someone sending an EDR for the first time.</p>
<p>It is not uncommon to see fake EDR vendors claim the ability to send data requests through Kodex, with some even sharing redacted screenshots of police accounts at Kodex.</p>
<p><strong>Matt Donahue</strong> is the former FBI agent who founded Kodex in 2021. Donahue said just because someone can use a legitimate police department or government email to create a Kodex account doesn&#8217;t mean that user will be able to send anything. Donahue said even if one customer gets a fake request, Kodex is able to prevent the same thing from happening to another.</p>
<p>Kodex told KrebsOnSecurity that over the past 12 months it has processed a total of 1,597 EDRs, and that 485 of those requests (~30 percent) failed a second-level verification. Kodex reports it has suspended nearly 4,000 law enforcement users in the past year, including:</p>
<p>-1,521 from the Asia-Pacific region;<br />
-1,290 requests from Europe, the Middle East and Asia;<br />
-460 from police departments and agencies in the United States;<br />
-385 from entities in Latin America, and;<br />
-285 from Brazil.</p>
<p>Donahue said 60 technology companies are now routing all law enforcement data requests through Kodex, including an increasing number of financial institutions and cryptocurrency platforms. He said one concern shared by recent prospective customers is that crooks are seeking to use phony law enforcement requests to freeze and in some cases seize funds in specific accounts.</p>
<p>&#8220;What&#8217;s being conflated [with EDRs] is anything that doesn&#8217;t involve a formal judge&#8217;s signature or legal process,&#8221; Donahue said. &#8220;That can include control over data, like an account freeze or preservation request.&#8221;</p>
<p>In a hypothetical example, a scammer uses a hacked government email account to request that a service provider place a hold on a specific bank or crypto account that is allegedly subject to a garnishment order, or party to crime that is globally sanctioned, such as terrorist financing or child exploitation.</p>
<p>A few days or weeks later, the same impersonator returns with a request to seize funds in the account, or to divert the funds to a custodial wallet supposedly controlled by government investigators.</p>
<p>&#8220;In terms of overall social engineering attacks, the more you have a relationship with someone the more they&#8217;re going to trust you,&#8221; Donahue said. &#8220;If you send them a freeze order, that&#8217;s a way to establish trust, because [the first time] they&#8217;re not asking for information. They&#8217;re just saying, &#8216;Hey can you do me a favor?&#8217; And that makes the [recipient] feel valued.&#8221;</p>
<p>Echoing the FBI&#8217;s warning, Donahue said far too many police departments in the United States and other countries have poor account security hygiene, and often do not enforce basic account security precautions &#8212; such as requiring phishing-resistant multifactor authentication.</p>
<p>How are cybercriminals typically gaining access to police and government email accounts? Donahue said it&#8217;s still mostly email-based phishing, and credentials that are stolen by opportunistic malware infections and sold on the dark web. But as bad as things are internationally, he said, many law enforcement entities in the United States still have much room for improvement in account security.</p>
<p>&#8220;Unfortunately, a lot of this is phishing or malware campaigns,&#8221; Donahue said. &#8220;A lot of global police agencies don&#8217;t have stringent cybersecurity hygiene, but even U.S. dot-gov emails get hacked. Over the last nine months, I&#8217;ve reached out to CISA (the Cybersecurity and Infrastructure Security Agency) over a dozen times about .gov email addresses that were compromised and that CISA was unaware of.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=69463
title: Microsoft Patch Tuesday, November 2024 Edition
uri: Microsoft-Patch-Tuesday-November-2024-Edition
url: https://krebsonsecurity.com/2024/11/microsoft-patch-tuesday-november-2024-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug at least 89 security holes in its <strong>Windows</strong> operating systems and other software. November&#8217;s patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today.</p>
<p><img decoding="async" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The zero-day flaw tracked as <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49039" target="_blank" rel="noopener">CVE-2024-49039</a> is a bug in the <strong>Windows Task Scheduler</strong> that allows an attacker to increase their privileges on a Windows machine. Microsoft credits Google&#8217;s <strong>Threat Analysis Group</strong> with reporting the flaw.</p>
<p>The second bug fixed this month that is already seeing in-the-wild exploitation is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43451" target="_blank" rel="noopener">CVE-2024-43451</a>, a spoofing flaw that could reveal <a href="https://www.ired.team/offensive-security/initial-access/netntlmv2-hash-stealing-using-outlook" target="_blank" rel="noopener">Net-NTLMv2 hashes</a>, which are used for authentication in Windows environments.</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, says the danger with stolen NTLM hashes is that they enable so-called &#8220;pass-the-hash&#8221; attacks, which let an attacker masquerade as a legitimate user without ever having to log in or know the user&#8217;s password. Narang notes that CVE-2024-43451 is the third NTLM zero-day so far this year.</p>
<p>&#8220;Attackers continue to be adamant about discovering and exploiting zero-day vulnerabilities that can disclose NTLMv2 hashes, as they can be used to authenticate to systems and potentially move laterally within a network to access other systems,&#8221; Narang said.<span id="more-69463"></span></p>
<p>The two other publicly disclosed weaknesses Microsoft patched this month are <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49019" target="_blank" rel="noopener">CVE-2024-49019</a>, an elevation of privilege flaw in <strong>Active Directory Certificate Services</strong> (AD CS); and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49040" target="_blank" rel="noopener">CVE-2024-49040</a>, a spoofing vulnerability in <strong>Microsoft Exchange Server</strong>.</p>
<p><strong>Ben McCarthy</strong>, lead cybersecurity engineer at <strong>Immersive Labs</strong>, called special attention to <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43602" target="_blank" rel="noopener">CVE-2024-43602</a>, a remote code execution vulnerability in <strong>Windows Kerberos</strong>, the authentication protocol that is heavily used in Windows domain networks.</p>
<p>&#8220;This is one of the most threatening CVEs from this patch release,&#8221; McCarthy said. &#8220;Windows domains are used in the majority of enterprise networks, and by taking advantage of a cryptographic protocol vulnerability, an attacker can perform privileged acts on a remote machine within the network, potentially giving them eventual access to the domain controller, which is the goal for many attackers when attacking a domain.&#8221;</p>
<p>McCarthy also pointed to <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43498" target="_blank" rel="noopener">CVE-2024-43498</a>, a remote code execution flaw in <strong>.NET</strong> and <strong>Visual Studio</strong> that could be used to install malware. This bug has earned a CVSS severity rating of 9.8 (10 is the worst).</p>
<p>Finally, at least 29 of the updates released today tackle memory-related security issues involving <strong>SQL server</strong>, each of which earned a threat score of 8.8. Any one of these bugs could be used to install malware if an authenticated user connects to a malicious or hacked SQL database server.</p>
<p>For a more detailed breakdown of today&#8217;s patches from Microsoft, check out the <a href="https://isc.sans.edu/diary/Microsoft%20November%202024%20Patch%20Tuesday/31438" target="_blank" rel="noopener">SANS Internet Storm Center’s list</a>. For administrators in charge of managing larger Windows environments, it pays to keep an eye on <a href="https://www.askwoody.com/" target="_blank" rel="noopener">Askwoody.com</a>, which frequently points out when specific Microsoft updates are creating problems for a number of users.</p>
<p>As always, if you experience any problems applying any of these updates, consider dropping a note about it in the comments; chances are excellent that someone else reading here has experienced the same issue, and maybe even has found a solution.</p>


feed_id: https://krebsonsecurity.com/?p=69482
title: An Interview With the Target & Home Depot Hacker
uri: An-Interview-With-the-Target-Home-Depot-Hacker
url: https://krebsonsecurity.com/2024/11/an-interview-with-the-target-home-depot-hacker/
content:
<p>In December 2023, KrebsOnSecurity revealed the real-life identity of <strong>Rescator</strong>, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from <strong>Target</strong> and <strong>Home Depot</strong> between 2013 and 2014. Moscow resident <strong>Mikhail Shefel</strong>, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes.</p>
<div id="attachment_67207" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67207" decoding="async" class=" wp-image-67207" src="media/ddbe5ba2.shefel-fb1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1.png" alt="" width="750" height="572" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1.png 942w, https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1-768x585.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1-782x596.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67207" class="wp-caption-text">Mikhail &#8220;Mike&#8221; Shefel&#8217;s former Facebook profile. Shefel has since legally changed his last name to Lenin.</p></div>
<p>Mr. Shefel, who recently changed his legal surname to <strong>Lenin</strong>, was the star of last year&#8217;s story, <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">Ten Years Later, New Clues in the Target Breach</a>. That investigation detailed how the 38-year-old Shefel adopted the nickname Rescator while working as vice president of payments at <strong>ChronoPay</strong>, a Russian financial company that paid spammers to advertise fake antivirus scams, male enhancement drugs and knockoff pharmaceuticals.</p>
<p>Mr. Shefel did not respond to requests for comment in advance of that December 2023 profile. Nor did he respond to reporting here in January 2024 that he ran an IT company with a 34-year-old Russian man named <strong>Aleksandr Ermakov</strong>, who was sanctioned by authorities in Australia, the U.K. and U.S. for <a href="https://krebsonsecurity.com/2024/01/who-is-alleged-medibank-hacker-aleksandr-ermakov/" target="_blank" rel="noopener">stealing data on nearly 10 million customers of the Australian health insurance giant Medibank</a>.</p>
<p>But not long after KrebsOnSecurity reported in April that Shefel/Rescator also was behind <a href="https://krebsonsecurity.com/2024/04/who-stole-3-6m-tax-records-from-south-carolina/" target="_blank" rel="noopener">the theft of Social Security and tax information</a> from a majority of South Carolina residents in 2012, Mr. Shefel began contacting this author with the pretense of setting the record straight on his alleged criminal hacking activities.</p>
<p>In a series of live video chats and text messages, Mr. Shefel confirmed he indeed went by the Rescator identity for several years, and that he did operate a slew of websites between 2013 and 2015 that sold payment card data stolen from Target, Home Depot and a number of other nationwide retail chains.</p>
<p>Shefel claims the true mastermind behind the Target and other retail breaches was <a href="https://www.wired.com/2007/01/tracking-the-russian-scammers/" target="_blank" rel="noopener"><strong>Dmitri Golubov</strong></a>, an infamous Ukrainian hacker known as the co-founder of Carderplanet, among the earliest Russian-language cybercrime forums focused on payment card fraud. Mr. Golubov could not be reached for comment, and Shefel says he no longer has the laptop containing evidence to support that claim.</p>
<p>Shefel asserts he and his team were responsible for developing the card-stealing malware that Golubov&#8217;s hackers installed on Target and Home Depot payment terminals, and that at the time he was technical director of a long-running Russian cybercrime community called <a href="https://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/" target="_blank" rel="noopener">Lampeduza</a>.</p>
<p>&#8220;My nickname was MikeMike, and I worked with Dmitri Golubov and made technologies for him,&#8221; Shefel said. &#8220;I&#8217;m also godfather of his second son.&#8221;</p>
<div id="attachment_69494" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69494" decoding="async" loading="lazy" class=" wp-image-69494" src="media/c93b61c6.script-cp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/script-cp.png" alt="" width="750" height="733" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/script-cp.png 780w, https://krebsonsecurity.com/wp-content/uploads/2024/11/script-cp-768x750.png 768w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69494" class="wp-caption-text">Dmitri Golubov, circa 2005. Image: U.S. Postal Investigative Service.</p></div>
<p>A week after breaking the story about the 2013 data breach at Target, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank" rel="noopener">Who&#8217;s Selling Cards from Target?</a>, which identified a Ukrainian man who went by the nickname <strong>Helkern</strong> as Rescator&#8217;s original identity. But Shefel claims Helkern was subordinate to Golubov, and that he was responsible for introducing the two men more than a decade ago.</p>
<p>&#8220;Helkern was my friend, I [set up a] meeting with Golubov and him in 2013,&#8221; Shefel said. &#8220;That was in Odessa, Ukraine. I was often in that city, and [it&#8217;s where] I met my second wife.&#8221;</p>
<p>Shefel claims he made several hundred thousand dollars selling cards stolen by Golubov&#8217;s Ukraine-based hacking crew, but that not long after Russia annexed Crimea in 2014 Golubov cut him out of the business and replaced Shefel&#8217;s malware coding team with programmers in Ukraine.<span id="more-69482"></span></p>
<p>Golubov was arrested in Ukraine in 2005 as part of a joint investigation with multiple U.S. federal law enforcement agencies, but his political connections in the country ensured his case went nowhere. Golubov later earned immunity from prosecution by becoming an elected politician and <a href="https://www.spiegel.de/netzwelt/web/dimitri-iwanowitsch-golubow-gesuchter-hacker-als-darth-vader-a-903751.html" target="_blank" rel="noopener">founding the Internet Party of Ukraine</a>, which called for free internet for all, the creation of country-wide &#8220;hacker schools&#8221; and the &#8220;computerization of the entire economy.&#8221;</p>
<p>Mr. Shefel says he stopped selling stolen payment cards after being pushed out of the business, and invested his earnings in a now-defunct Russian search engine called <a href="https://web.archive.org/web/20170630180838/http://tf.org/" target="_blank" rel="noopener">tf[.]org</a>. He also apparently ran <a href="https://www.youtube.com/watch?v=9sr3VIXwKMI" target="_blank" rel="noopener">a business called click2dad[.]net</a> that paid people to click on ads for Russian government employment opportunities.</p>
<p>When those enterprises fizzled out, Shefel reverted to selling malware coding services for hire under the nickname &#8220;<strong>Getsend</strong>&#8220;; this claim checks out, as Getsend for many years advertised the same Telegram handle that Shefel used in our recent chats and video calls.</p>
<div id="attachment_69492" style="width: 294px" class="wp-caption alignright"><img aria-describedby="caption-attachment-69492" decoding="async" loading="lazy" class="size-full wp-image-69492" src="media/39890adb.shefel-tg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/shefel-tg.png" alt="" width="284" height="608" /><p id="caption-attachment-69492" class="wp-caption-text">A screenshot of a Telegram conversation with Mikhail Shefel/Lenin.</p></div>
<p>Shefel acknowledged that his outreach was motivated by a desire to publicize several new business ventures. None of those will be mentioned here because Shefel is already using my December 2023 profile of him to advertise what appears to be a pyramid scheme, and to remind others within the Russian hacker community of his skills and accomplishments.</p>
<p>Shefel says he is now flat broke, and that he currently has little to show for a storied hacking career. The Moscow native said he recently heard from his ex-wife, who had read last year&#8217;s story about him and was suddenly wondering where he&#8217;d hidden all of his earnings.</p>
<p>More urgently, Shefel needs money to stay out of prison. In February, he and Ermakov were arrested on charges of operating a short-lived ransomware affiliate program in 2021 called <strong>Sugar</strong> (a.k.a. Sugar Locker), which targeted single computers and end-users instead of corporations. Shefel is due to face those charges in a Moscow court on Friday, Nov. 15, 2024. Ermakov was recently found guilty and given two years probation.</p>
<p>Shefel claims his Sugar ransomware affiliate program was a bust, and never generated any profits. Russia is known for not prosecuting criminal hackers within its borders who scrupulously avoid attacking Russian businesses and consumers. When asked why he now faces prosecution over Sugar, Shefel said he&#8217;s certain the investigation was instigated by  <strong>Pyotr &#8220;Peter&#8221; Vrublevsky</strong> &#8212; the son of his former boss at ChronoPay.</p>
<p>ChronoPay founder and CEO <strong>Pavel Vrublevsky</strong> was the key subject of my 2014 book <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0" target="_blank" rel="noopener"><em>Spam Nation</em></a>, which described his role as head of one of Russia&#8217;s most notorious criminal spam operations.</p>
<p>Vrublevsky Sr. recently declared bankruptcy, and is currently in prison on fraud charges. Russian authorities allege Vrublevsky operated several fraudulent SMS-based payment schemes. They also accused Vrublevsky of facilitating money laundering for <a href="https://en.wikipedia.org/wiki/Hydra_Market" target="_blank" rel="noopener">Hydra</a>, the largest Russian darknet market at the time. Hydra trafficked in illegal drugs and financial services, including cryptocurrency tumbling for money laundering, exchange services between cryptocurrency and Russian rubles, and the sale of falsified documents and hacking services.</p>
<p>However, in 2022 KrebsOnSecurity reported on <a href="https://krebsonsecurity.com/2022/03/spam-nation-villain-vrublevsky-charged-with-fraud/" target="_blank" rel="noopener">a more likely reason for Vrublevsky&#8217;s latest criminal charges</a>: He&#8217;d been extensively documenting the nicknames, real names and criminal exploits of Russian hackers who worked with the protection of corrupt officials in the Russian Federal Security Service (FSB), and operating a Telegram channel that threatened to expose alleged nefarious dealings by Russian financial executives.</p>
<p>Shefel believes Vrublevsky&#8217;s son Peter paid corrupt cops to levy criminal charges against him after reporting the youth to Moscow police, allegedly for walking around in public with a loaded firearm. Shefel says the Russian authorities told the younger Vrublevsky that he had lodged the firearms complaint.</p>
<p>In July 2024, the Russian news outlet <em>Izvestia</em> published <a href="https://iz.ru/1731854/antonina-matveeva-maksim-solopov-stanislav-kuchushev/reklamnaia-doza-kto-stoit-za-pr-aktciiami-lidera-narkotorgovli-v-rossii" target="_blank" rel="noopener">a lengthy investigation into Peter Vrublevsky</a>, alleging that the younger son took up his father&#8217;s mantle and was responsible for advertising <strong>Sprut</strong>, a Russian-language narcotics bazaar that sprang to life after the Hydra darknet market was <a href="https://krebsonsecurity.com/2022/04/actions-target-russian-govt-botnet-hydra-dark-market/" target="_blank" rel="noopener">shut down by international law enforcement agencies in 2022</a>.</p>
<div id="attachment_69493" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69493" decoding="async" loading="lazy" class=" wp-image-69493" src="media/03ee023b.sprut-moscow.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/sprut-moscow.png" alt="" width="750" height="431" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/sprut-moscow.png 1035w, https://krebsonsecurity.com/wp-content/uploads/2024/11/sprut-moscow-768x442.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/sprut-moscow-782x450.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69493" class="wp-caption-text">Izvestia reports that Peter Vrublevsky was the advertising mastermind behind this 3D ad campaign and others promoting the Russian online narcotics bazaar Sprut.</p></div>
<p>Izvestia reports that Peter Vrublevsky is currently living in Switzerland, where he reportedly fled in 2022 after being &#8220;arrested in absentia&#8221; in Russia on charges of running a violent group that could be hired via Telegram to conduct a range of physical attacks in real life, including firebombings and muggings.</p>
<p>Shefel claims his former partner Golubov was involved in the development and dissemination of early ransomware strains, including <a href="https://krebsonsecurity.com/2013/11/cryptolocker-crew-ratchets-up-the-ransom/" target="_blank" rel="noopener">Cryptolocker</a>, and that Golubov remains active in the cybercrime community.</p>
<p>Meanwhile, Mr. Shefel portrays himself as someone who is barely scraping by with the few odd coding jobs that come his way each month. Incredibly, the day after our initial interview via Telegram, Shefel proposed going into business together.</p>
<p>By way of example, he suggested maybe a company centered around recovering lost passwords for cryptocurrency accounts, or perhaps a series of online retail stores that sold cheap Chinese goods at a steep markup in the United States.</p>
<p>&#8220;Hi, how are you?&#8221; he inquired. &#8220;Maybe we can open business?&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=69538
title: Fintech Giant Finastra Investigating Data Breach
uri: Fintech-Giant-Finastra-Investigating-Data-Breach
url: https://krebsonsecurity.com/2024/11/fintech-giant-finastra-investigating-data-breach/
content:
<p>The financial technology firm <strong>Finastra</strong> is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world&#8217;s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.</p>
<p><img decoding="async" class="aligncenter wp-image-50961" src="media/b38c8607.finastra.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/finastra.png" alt="" width="747" height="453" /></p>
<p>London-based Finastra has offices in 42 countries and reported $1.9 billion in revenues last year. The company employs more than 7,000 people and serves approximately 8,100 financial institutions around the world. A major part of Finastra&#8217;s day-to-day business involves processing huge volumes of digital files containing instructions for wire and bank transfers on behalf of its clients.</p>
<p>On November 8, 2024, Finastra notified financial institution customers that on Nov. 7 its security team detected suspicious activity on Finastra&#8217;s internally hosted file transfer platform. Finastra also told customers that someone had begun selling large volumes of files allegedly stolen from its systems.</p>
<p>&#8220;On November 8, a threat actor communicated on the dark web claiming to have data exfiltrated from this platform,&#8221; reads <a href="media/007af246.finastra-notice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-notice.png" target="_blank" rel="noopener">Finastra&#8217;s disclosure</a>, a copy of which was shared by a source at one of the customer firms.</p>
<p>&#8220;There is no direct impact on customer operations, our customers&#8217; systems, or Finastra&#8217;s ability to serve our customers currently,&#8221; the notice continued. &#8220;We have implemented an alternative secure file sharing platform to ensure continuity, and investigations are ongoing.&#8221;</p>
<p>But its notice to customers does indicate the intruder managed to extract or &#8220;exfiltrate&#8221; an unspecified volume of customer data.</p>
<p>&#8220;The threat actor did not deploy malware or tamper with any customer files within the environment,&#8221; the notice reads. &#8220;Furthermore, no files other than the exfiltrated files were viewed or accessed. We remain focused on determining the scope and nature of the data contained within the exfiltrated files.&#8221;<span id="more-69538"></span></p>
<p>In a written statement in response to questions about the incident, Finastra said it has been &#8220;actively and transparently responding to our customers’ questions and keeping them informed about what we do and do not yet know about the data that was posted.&#8221; The company also shared an updated communication to its clients, which said while it was still investigating the root cause, &#8220;initial evidence points to credentials that were compromised.&#8221;</p>
<p>&#8220;Additionally, we have been sharing Indicators of Compromise (IOCs) and our CISO has been speaking directly with our customers’ security teams to provide updates on the investigation and our eDiscovery process,&#8221; the statement continues. Here is the rest of what they shared:</p>
<blockquote><p>&#8220;In terms of eDiscovery, we are analyzing the data to determine what specific customers were affected, while simultaneously assessing and communicating which of our products are not dependent on the specific version of the SFTP platform that was compromised. The impacted SFTP platform is not used by all customers and is not the default platform used by Finastra or its customers to exchange data files associated with a broad suite of our products, so we are working as quickly as possible to rule out affected customers. However, as you can imagine, this is a time-intensive process because we have many large customers that leverage different Finastra products in different parts of their business. We are prioritizing accuracy and transparency in our communications.</p>
<p>Importantly, for any customers who are deemed to be affected, we will be reaching out and working with them directly.&#8221;</p></blockquote>
<p>On Nov. 8, a cybercriminal using the nickname &#8220;<strong>abyss0</strong>&#8221; posted on the English-language cybercrime community <strong>BreachForums</strong> that they&#8217;d stolen files belonging to some of Finastra&#8217;s largest banking clients. The data auction did not specify a starting or &#8220;buy it now&#8221; price, but said interested buyers should reach out to them on Telegram.</p>
<div id="attachment_69542" style="width: 760px" class="wp-caption aligncenter"><a href="media/835637f7.finastra-sales-nov8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-sales-nov8.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69542" decoding="async" loading="lazy" class="wp-image-69542" src="media/835637f7.finastra-sales-nov8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-sales-nov8.png" alt="" width="750" height="489" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-sales-nov8.png 1052w, https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-sales-nov8-768x500.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-sales-nov8-782x509.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-69542" class="wp-caption-text">abyss0&#8217;s Nov. 7 sales thread on BreachForums included many screenshots showing the file directory listings for various Finastra customers. Image: Ke-la.com.</p></div>
<p>According to screenshots collected by the cyber intelligence platform <a href="https://www.ke-la.com" target="_blank" rel="noopener">Ke-la.com</a>, abyss0 first attempted to sell the data allegedly stolen from Finastra on October 31, but that earlier sales thread did not name the victim company. However, it did reference many of the same banks called out as Finastra customers in the Nov. 8 post on BreachForums.</p>
<div id="attachment_69540" style="width: 758px" class="wp-caption aligncenter"><a href="media/0e5f86cb.finastra-bf-oct2024.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-bf-oct2024.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69540" decoding="async" loading="lazy" class="wp-image-69540" src="media/0e5f86cb.finastra-bf-oct2024.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-bf-oct2024.png" alt="" width="748" height="422" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-bf-oct2024.png 1057w, https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-bf-oct2024-768x433.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/finastra-bf-oct2024-782x441.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-69540" class="wp-caption-text">The original October 31 post from abyss0, where they advertise the sale of data from several large banks that are customers of a large financial software company. Image: Ke-la.com.</p></div>
<p>The October sales thread also included a starting price: $20,000. By Nov. 3, that price had been reduced to $10,000. A review of abyss0&#8217;s posts to BreachForums reveals this user has offered to sell databases stolen in several dozen other breaches advertised over the past six months.</p>
<p>The apparent timeline of this breach suggests abyss0 gained access to Finastra&#8217;s file sharing system at least a week before the company says it first detected suspicious activity, and that the Nov. 7 activity cited by Finastra may have been the intruder returning to exfiltrate more data.</p>
<p>Maybe abyss0 found a buyer who paid for their early retirement. We may never know, because this person has effectively vanished. The Telegram account that abyss0 listed in their sales thread appears to have been suspended or deleted. Likewise, abyss0&#8217;s account on BreachForums no longer exists, and all of their sales threads have since disappeared.</p>
<p>It seems improbable that both Telegram and BreachForums would have given this user the boot at the same time. The simplest explanation is that something spooked abyss0 enough for them to abandon a number of pending sales opportunities, in addition to a well-manicured cybercrime persona.</p>
<p>In March 2020, Finastra <a href="https://krebsonsecurity.com/2020/03/security-breach-disrupts-fintech-firm-finastra/" target="_blank" rel="noopener">suffered a ransomware attack</a> that sidelined a number of the company&#8217;s core businesses for days. According to <a href="https://www.bloomberg.com/news/articles/2020-04-08/how-finastra-survived-a-ransomware-attack-without-paying-ransom" target="_blank" rel="noopener">reporting from Bloomberg</a>, Finastra was able to recover from that incident without paying a ransom.</p>
<p><em>This is a developing story. Updates will be noted with timestamps. If you have any additional information about this incident, please reach out to krebsonsecurity @ gmail.com or at protonmail.com.</em></p>


feed_id: https://krebsonsecurity.com/?p=69568
title: Feds Charge Five Men in ‘Scattered Spider’ Roundup
uri: Feds-Charge-Five-Men-in-Scattered-Spider-Roundup
url: https://krebsonsecurity.com/2024/11/feds-charge-five-men-in-scattered-spider-roundup/
content:
<p>Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including <strong>LastPass</strong>, <strong>MailChimp</strong>, <strong>Okta</strong>, <strong>T-Mobile</strong> and <strong>Twilio</strong>.</p>
<div id="attachment_61104" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61104" decoding="async" class=" wp-image-61104" src="media/4f893eb1.amitaico.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/amitaico.png" alt="" width="749" height="441" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/amitaico.png 1427w, https://krebsonsecurity.com/wp-content/uploads/2022/08/amitaico-768x452.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/amitaico-782x460.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-61104" class="wp-caption-text">A visual depiction of the attacks by the SMS phishing group known as Scattered Spider, and Oktapus. Image: Amitai Cohen twitter.com/amitaico.</p></div>
<p>The five men, aged 20 to 25, are allegedly members of a hacking conspiracy dubbed &#8220;<strong>Scattered Spider</strong>&#8221; and &#8220;<strong>Oktapus</strong>,&#8221; which specialized in SMS-based phishing attacks that tricked employees at tech firms into entering their credentials and one-time passcodes at phishing websites.</p>
<p>The targeted SMS scams asked employees to click a link and log in at a website that mimicked their employer’s Okta authentication page. Some SMS phishing messages told employees their VPN credentials were expiring and needed to be changed; other phishing messages advised employees about changes to their upcoming work schedule.</p>
<p>These attacks leveraged newly-registered domains that often included the name of the targeted company, such as <a href="https://urlscan.io/result/ca9d3120-7c5f-4502-8faf-09a94274ba71/" target="_blank" rel="noopener">twilio-help[.]com</a> and <a href="https://urlscan.io/result/d17edad8-ef65-4d25-a0eb-39b7cc4ab593/" target="_blank" rel="noopener">ouryahoo-okta[.]com</a>. The phishing websites were normally kept online for just one or two hours at a time, meaning they were often yanked offline before they could be flagged by anti-phishing and security services.</p>
<p>The phishing kits used for these campaigns featured a hidden Telegram instant message bot that forwarded any submitted credentials in real-time. The bot allowed the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website.</p>
<p>In August 2022, multiple security firms gained access to the server that was receiving data from that Telegram bot, which on several occasions leaked the Telegram ID and handle of its developer, who used the nickname &#8220;<strong>Joeleoli</strong>.&#8221;</p>
<div id="attachment_69574" style="width: 758px" class="wp-caption aligncenter"><a href="media/97c72ff8.joeleoli-tg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/joeleoli-tg.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69574" decoding="async" loading="lazy" class="wp-image-69574" src="media/97c72ff8.joeleoli-tg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/joeleoli-tg.png" alt="" width="748" height="173" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/joeleoli-tg.png 1287w, https://krebsonsecurity.com/wp-content/uploads/2024/11/joeleoli-tg-768x177.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/joeleoli-tg-782x180.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-69574" class="wp-caption-text">The Telegram username &#8220;Joeleoli&#8221; can be seen sandwiched between data submitted by people who knew it was a phish, and data phished from actual victims. Click to enlarge.</p></div>
<p>That Joeleoli moniker registered on the cybercrime forum <strong>OGusers</strong> in 2018 with the email address <strong>joelebruh@gmail.com</strong>, which also was used to register accounts at several websites for a Joel Evans from North Carolina. Indeed, prosecutors say Joeleoli&#8217;s real name is <strong>Joel Martin Evans</strong>, and he is a 25-year-old from Jacksonville, North Carolina.<span id="more-69568"></span></p>
<p>One of Scattered Spider’s first big victims in its 2022 SMS phishing spree was <strong>Twilio</strong>, a company that provides services for making and receiving text messages and phone calls. The group then used their access to Twilio to attack at least 163 of its customers. According to prosecutors, the group mainly sought to steal cryptocurrency from victim companies and their employees.</p>
<p>&#8220;The defendants allegedly preyed on unsuspecting victims in this phishing scheme and used their personal information as a gateway to steal millions in their cryptocurrency accounts,” <a href="https://www.justice.gov/usao-cdca/pr/5-defendants-charged-federally-running-scheme-targeted-victim-companies-phishing-text" target="_blank" rel="noopener">said</a> <strong>Akil Davis</strong>, the assistant director in charge of the FBI’s Los Angeles field office.</p>
<p>Many of the hacking group&#8217;s phishing domains were registered through the registrar <strong>NameCheap</strong>, and FBI investigators said records obtained from NameCheap showed the person who managed those phishing websites did so from an Internet address in Scotland. The feds then obtained records from Virgin Media, which showed the address was leased for several months to <strong>Tyler Buchanan</strong>, a 22-year-old from Dundee, Scotland.</p>
<div id="attachment_61078" style="width: 654px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61078" decoding="async" loading="lazy" class="wp-image-61078 size-full" src="media/70fc6af9.twiliophish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/twiliophish.png" alt="" width="644" height="471" /><p id="caption-attachment-61078" class="wp-caption-text">A Scattered Spider phishing lure sent to Twilio employees.</p></div>
<p>As <a href="https://krebsonsecurity.com/2024/06/alleged-boss-of-scattered-spider-hacking-group-arrested/" target="_blank" rel="noopener">first reported here in June</a>, Buchanan was arrested in Spain as he tried to board a flight bound for Italy. The Spanish police told local media that Buchanan, who allegedly went by the alias &#8220;<strong>Tylerb</strong>,&#8221; at one time possessed Bitcoins worth $27 million.</p>
<p>The government says much of Tylerb&#8217;s cryptocurrency wealth was the result of successful <strong>SIM-swapping</strong> attacks, wherein crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls sent to the victim — including one-time passcodes for authentication, or password reset links sent via SMS.</p>
<p>According to several SIM-swapping channels on Telegram where Tylerb was known to frequent, rival SIM-swappers hired thugs to invade his home in February 2023. Those accounts state that the intruders assaulted Tylerb’s mother in the home invasion, and that they threatened to burn him with a blowtorch if he didn’t give up the keys to his cryptocurrency wallets. Tylerb was reputed to have fled the United Kingdom after that assault.</p>
<div id="attachment_67783" style="width: 721px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67783" decoding="async" loading="lazy" class=" wp-image-67783" src="media/49a7c375.tylerb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/tylerb.png" alt="" width="711" height="293" /><p id="caption-attachment-67783" class="wp-caption-text">A still frame from a video released by the Spanish national police, showing Tyler Buchanan being taken into custody at the airport.</p></div>
<p>Prosecutors allege Tylerb worked closely on SIM-swapping attacks with <strong>Noah Michael Urban</strong>, another alleged Scattered Spider member from Palm Coast, Fla. who went by the handles &#8220;<strong>Sosa</strong>,&#8221; &#8220;<strong>Elijah</strong>,&#8221; and &#8220;<strong>Kingbob</strong>.&#8221;</p>
<p>Sosa was known to be a top member of the broader cybercriminal community online known as “<strong>The Com</strong>,” wherein hackers boast loudly about high-profile exploits and hacks that almost invariably begin with social engineering — tricking people over the phone, email or SMS into giving away credentials that allow remote access to corporate networks.</p>
<p>In January 2024, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/" target="_blank" rel="noopener">broke the news</a> that Urban had been arrested in Florida in connection with multiple SIM-swapping attacks. That story noted that Sosa&#8217;s alter ego Kingbob routinely targeted people in the recording industry to steal and share &#8220;grails,&#8221; a slang term used to describe unreleased music recordings from popular artists.</p>
<p>FBI investigators identified a fourth alleged member of the conspiracy &#8211; <strong>Ahmed Hossam Eldin Elbadawy</strong>, 23, of College Station, Texas &#8212; after he used a portion of cryptocurrency funds stolen from a victim company to pay for an account used to register phishing domains.</p>
<p>The indictment unsealed Wednesday alleges Elbadawy controlled a number of cryptocurrency accounts used to receive stolen funds, along with another Texas man &#8212; <strong>Evans Onyeaka Osiebo</strong>, 20, of Dallas.</p>
<p>Members of Scattered Spider are reputed to have been involved in <a href="https://archive.ph/MuU4s" target="_blank" rel="noopener">a September 2023 ransomware attack</a> against the <strong>MGM Resorts</strong> hotel chain that quickly brought multiple MGM casinos to a standstill. In September 2024, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/" target="_blank" rel="noopener">reported</a> that a 17-year-old from the United Kingdom was arrested last year by U.K. police as part of an FBI investigation into the MGM hack.</p>
<p>Evans, Elbadawy, Osiebo and Urban were all charged with one count of conspiracy to commit wire fraud, one count of conspiracy, and one count of aggravated identity theft. Buchanan, who is named as an indicted co-conspirator, was charged with conspiracy to commit wire fraud, conspiracy, wire fraud, and aggravated identity theft.</p>
<p>A Justice Department <a href="https://www.justice.gov/usao-cdca/pr/5-defendants-charged-federally-running-scheme-targeted-victim-companies-phishing-text" target="_blank" rel="noopener">press release</a> states that if convicted, each defendant would face a statutory maximum sentence of 20 years in federal prison for conspiracy to commit wire fraud, up to five years in federal prison for the conspiracy count, and a mandatory two-year consecutive prison sentence for aggravated identity theft. Buchanan would face up to 20 years in prison for the wire fraud count as well.</p>
<p>Further reading:</p>
<p><a href="media/71f18d3d.USA-v-Buchanan-COMPLAINT-Redacted.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/USA-v-Buchanan-COMPLAINT-Redacted.pdf" target="_blank" rel="noopener">The redacted complaint against Buchanan</a> (PDF)</p>
<p><a href="media/3d089f26.USA-v-Elbadawy-et-al-INDICTMENT.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/USA-v-Elbadawy-et-al-INDICTMENT.pdf" target="_blank" rel="noopener">Charges against Urban and the other defendants</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=69605
title: Hacker in Snowflake Extortions May Be a U.S. Soldier
uri: Hacker-in-Snowflake-Extortions-May-Be-a-U-S-Soldier
url: https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/
content:
<p>Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company <strong>Snowflake</strong>, but a third suspect &#8212; a prolific hacker known as <strong>Kiberphant0m </strong>&#8212; remains at large and continues to publicly extort victims. However, this person&#8217;s identity may not remain a secret for long: A careful review of Kiberphant0m&#8217;s daily chats across multiple cybercrime personas suggests they are a U.S. Army soldier who is or was recently stationed in South Korea.</p>
<p>Kiberphant0m&#8217;s identities on cybercrime forums and on Telegram and Discord chat channels have been selling data stolen from customers of the cloud data storage company Snowflake. At the end of 2023, malicious hackers discovered that many companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with nothing more than a username and password (no multi-factor authentication required).</p>
<p>After scouring darknet markets for stolen Snowflake account credentials, the hackers began raiding the data storage repositories for some of the world’s largest corporations. Among those was <strong>AT&amp;T</strong>, which <a href="https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/" target="_blank" rel="noopener">disclosed in July</a> that cybercriminals had stolen personal information, phone and text message records for roughly 110 million people.  <strong>Wired.com</strong> <a href="https://www.wired.com/story/atandt-paid-hacker-300000-to-delete-stolen-call-records/" target="_blank" rel="noopener">reported in July</a> that AT&amp;T paid a hacker $370,000 to delete stolen phone records.</p>
<p>On October 30, Canadian authorities <a href="https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/" target="_blank" rel="noopener">arrested</a> <strong>Alexander Moucka, </strong>a.k.a.<strong> Connor Riley Moucka </strong>of Kitchener, Ontario, on a provisional arrest warrant from the United States, which has since indicted him on 20 criminal counts connected to the Snowflake breaches. Another suspect in the Snowflake hacks, <strong>John Erin Binns</strong>, is an American who is currently incarcerated in Turkey.</p>
<div id="attachment_69625" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69625" decoding="async" class=" wp-image-69625" src="media/826bf791.moucka-surveillance.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance.png" alt="" width="749" height="575" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance.png 1137w, https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance-768x590.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance-782x600.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-69625" class="wp-caption-text">A surveillance photo of Connor Riley Moucka, a.k.a. &#8220;Judische&#8221; and &#8220;Waifu,&#8221; dated Oct 21, 2024, 9 days before Moucka&#8217;s arrest. This image was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP).</p></div>
<p>Investigators say Moucka, who went by the handles <strong>Judische</strong> and <strong>Waifu</strong>, had tasked Kiberphant0m with selling data stolen from Snowflake customers who refused to pay a ransom to have their information deleted. Immediately after news broke of Moucka&#8217;s arrest, Kiberphant0m was clearly furious, and posted on the hacker community <strong>BreachForums</strong> what they claimed were the AT&amp;T call logs for <strong>President-elect</strong> <strong>Donald J. Trump</strong> and for <strong>Vice President Kamala Harris</strong>.</p>
<p>&#8220;In the event you do not reach out to us @ATNT all presidential government call logs will be leaked,&#8221; Kiberphant0m threatened, signing their post with multiple &#8220;#FREEWAIFU&#8221; tags. &#8220;You don&#8217;t think we don&#8217;t have plans in the event of an arrest? Think again.&#8221;</p>
<p>On the same day, Kiberphant0m posted what they claimed was the &#8220;data schema&#8221; from the <strong>U.S. National Security Agency</strong>.</p>
<p>&#8220;This was obtained from the ATNT Snowflake hack which is why ATNT paid an extortion,&#8221; Kiberphant0m wrote in a thread on BreachForums. &#8220;Why would ATNT pay Waifu for the data when they wouldn&#8217;t even pay an extortion for over 20M+ SSNs?&#8221;</p>
<div id="attachment_69624" style="width: 760px" class="wp-caption aligncenter"><a href="media/02ab1425.kiberphant0m-nsa-schema.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69624" decoding="async" loading="lazy" class="wp-image-69624" src="media/02ab1425.kiberphant0m-nsa-schema.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema.png" alt="" width="750" height="239" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema.png 1417w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema-768x245.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema-782x249.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-69624" class="wp-caption-text">Kiberphant0m posting what he claimed was a &#8220;data schema&#8221; stolen from the NSA via AT&amp;T.</p></div>
<p>Also on Nov. 5, Kiberphant0m offered call logs stolen from Verizon&#8217;s push-to-talk (PTT) customers &#8212; mainly U.S. government agencies and emergency first responders. On Nov. 9, Kiberphant0m posted a sales thread on BreachForums offering a &#8220;SIM-swapping&#8221; service targeting Verizon PTT customers. In a SIM-swap, fraudsters use credentials that are phished or stolen from mobile phone company employees to divert a target&#8217;s phone calls and text messages to a device they control.</p>
<h2>MEET &#8216;BUTTHOLIO&#8217;</h2>
<p>Kiberphant0m joined BreachForums in January 2024, but their public utterances on Discord and Telegram channels date back to at least early 2022. On their first post to BreachForums, Kiberphant0m said they could be reached at the Telegram handle <strong>@cyb3rph4nt0m</strong>.</p>
<p>A review of @cyb3rph4nt0m shows this user has posted more than 4,200 messages since January 2024. Many of these messages were attempts to recruit people who could be hired to deploy a piece of malware that enslaved host machines in an Internet of Things (IoT) botnet.</p>
<p>On BreachForums, Kiberphant0m has sold the source code to &#8220;<strong>Shi-Bot</strong>,&#8221; a custom Linux DDoS botnet based on <a href="https://krebsonsecurity.com/tag/mirai/" target="_blank" rel="noopener">the Mirai malware</a>. Kiberphant0m had few sales threads on BreachForums prior to the Snowflake attacks becoming public in May, and many of those involved databases stolen from companies in South Korea.</p>
<p>On June 5, 2024, a Telegram user by the name &#8220;<strong>Buttholio</strong>&#8221; joined the fraud-focused Telegram channel &#8220;<strong>Comgirl</strong>&#8221; and claimed to be Kiberphant0m. Buttholio made the claim after being taunted as a nobody by another denizen of Comgirl, referring to their @cyb3rph4nt0m account on Telegram and the Kiberphant0m user on cybercrime forums.</p>
<p>&#8220;Type &#8216;kiberphant0m&#8217; on google with the quotes,&#8221; Buttholio told another user. &#8220;I&#8217;ll wait. Go ahead. Over 50 articles. 15+ telecoms breached. I got the IMSI number to every single person that&#8217;s ever registered in Verizon, Tmobile, ATNT and Verifone.&#8221;</p>
<p>On Sept. 17, 2023, Buttholio posted in a Discord chat room dedicated to players of the video game <strong>Escape from Tarkov</strong>. &#8220;Come to Korea, servers there is pretty much no extract camper or cheater,&#8221; Buttholio advised.</p>
<p>In another message that same day in the gaming Discord, Buttholio told others they bought the game in the United States, but that they were playing it in Asia.</p>
<p>&#8220;USA is where the game was purchased from, server location is actual in game servers u play on. I am a u.s. soldier so i bought it in the states but got on rotation so i have to use asian servers,&#8221; they shared.<span id="more-69605"></span></p>
<h2>&#8216;REVERSESHELL&#8217;</h2>
<p>The account @Kiberphant0m was assigned the Telegram ID number 6953392511. A review of this ID at the cyber intelligence platform <a href="https://www.flashpoint.io" target="_blank" rel="noopener">Flashpoint</a> shows that on January 4, 2024 Kibertphant0m posted to the Telegram channel &#8220;Dstat,&#8221; which is populated by cybercriminals involved in launching distributed denial-of-service (DDoS) attacks and selling DDoS-for-hire services [Full disclosure: Flashpoint is currently an advertiser on this website].</p>
<p>Immediately after Kiberphant0m logged on to the Dstat channel, another user wrote &#8220;hi buttholio,&#8221; to which Kiberphant0m replied with an affirmative greeting &#8220;wsg,&#8221; or &#8220;what&#8217;s good.&#8221; On Nov. 1, <a href="https://www.bleepingcomputer.com/news/security/ddos-site-dstatcc-seized-and-two-suspects-arrested-in-germany/" target="_blank" rel="noopener">Dstat&#8217;s website dstat[.]cc was seized</a> as part of &#8220;Operation PowerOFF,&#8221; an international law enforcement action against DDoS services.</p>
<p>Flashpoint&#8217;s data shows that @kiberphant0m told a fellow member of Dstat on April 10, 2024 that their alternate Telegram username was &#8220;<strong>@reverseshell</strong>,&#8221; and did the same two weeks later in the Telegram chat The Jacuzzi. The Telegram ID for this account is <strong>5408575119</strong>.</p>
<p>Way back on Nov. 15, 2022, @reverseshell told a fellow member of a Telegram channel called Cecilio Chat that they were a soldier in the U.S. Army. This user also shared the following image of someone pictured waist-down in military fatigues, with a camouflaged backpack at their feet:</p>
<div id="attachment_69628" style="width: 665px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69628" decoding="async" loading="lazy" class="wp-image-69628 size-full" src="media/58f1a069.reverseshell-fatigues.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/reverseshell-fatigues.png" alt="" width="655" height="663" /><p id="caption-attachment-69628" class="wp-caption-text">Kiberphant0m&#8217;s apparent alias ReverseShell posted this image on a Telegram channel Cecilio Chat, on Nov. 15, 2022. Image: Flashpoint.</p></div>
<p>In September 2022, Reverseshell was embroiled in an argument with another member who had threatened to launch a DDoS attack against Reverseshell&#8217;s Internet address. After the promised attack materialized, Reverseshell responded, &#8220;Yall just hit military base contracted wifi.&#8221;</p>
<p>In a chat from October 2022, Reverseshell was bragging about the speed of the servers they were using, and in reply to another member&#8217;s question said that they were accessing the Internet via South Korea Telecom.</p>
<p>Telegram chat logs archived by Flashpoint show that on Aug. 23, 2022, Reverseshell bragged they&#8217;d been using automated tools to find valid logins for Internet servers that they resold to others.</p>
<p>&#8220;I&#8217;ve hit US gov servers with default creds,&#8221; Reverseshell wrote, referring to systems with easy-to-guess usernames and/or passwords. &#8220;Telecom control servers, machinery shops, Russian ISP servers, etc. I sold a few big companies for like $2-3k a piece. You can sell the access when you get a big SSH into corporation.&#8221;</p>
<p>On July 29, 2023, Reverseshell posted a screenshot of a login page for a major U.S. defense contractor, claiming they had an aerospace company&#8217;s credentials to sell.</p>
<h2>PROMAN AND VARS_SECC</h2>
<p>Flashpoint finds the Telegram ID 5408575119 has used several aliases since 2022, including Reverseshell and <strong>Proman557</strong>.</p>
<p>A search on the username Proman557 at the cyber intelligence platform <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> shows that a hacker by the name &#8220;<strong>Proman554</strong>&#8221; registered on Hackforums in September 2022, and in messages to other users Proman554 said they can be reached at the Telegram account Buttholio.</p>
<p>Intel 471 also finds the Proman557 moniker is one of many used by a person on the Russian-language hacking forum <strong>Exploit</strong> in 2022 who sold a variety of Linux-based botnet malware.</p>
<p>Proman557 was eventually banned &#8212; allegedly for scamming a fellow member out of $350 &#8212; and the Exploit moderator warned forum users that Proman557 had previously registered under several other nicknames, including an account called &#8220;<strong>Vars_Secc</strong>.&#8221;</p>
<p>Vars_Secc&#8217;s thousands of comments on Telegram over two years show this user divided their time between online gaming, maintaining a DDoS botnet, and promoting the sale or renting of their botnets to other users.</p>
<p>&#8220;I use ddos for many things not just to be a skid,&#8221; Vars_Secc pronounced. &#8220;Why do you think I haven’t sold my net?&#8221; They then proceeded to list the most useful qualities of their botnet:</p>
<blockquote><p>-I use it to hit off servers that ban me or piss me off<br />
-I used to ddos certain games to get my items back since the data reverts to when u joined<br />
-I use it for server side desync RCE vulnerabilities<br />
-I use it to sometimes ransom<br />
-I use it when bored as a source of entertainment</p></blockquote>
<p>Flashpoint shows that in June 2023, Vars_Secc responded to taunting from a fellow member in the Telegram channel SecHub who had threatened to reveal their personal details to the federal government for a reward.</p>
<p>&#8220;Man I’ve been doing this shit for 4 years,&#8221; Vars_Secc replied nonchalantly. &#8220;I highly doubt the government is going to pay millions of dollars for data on some random dude operating a pointless ddos botnet and finding a few vulnerabilities here and there.&#8221;</p>
<p>For several months in 2023, Vars_Secc also was an active member of the Russian-language crime forum <strong>XSS</strong>, where they sold access to a U.S. government server for $2,000. However, Vars_Secc would be banned from XSS after attempting to sell access to the Russian telecommunications giant <strong>Rostelecom</strong>. [In this, Vars_Secc violated the Number One Rule for operating on a Russia-based crime forum: Never offer to hack or sell data stolen from Russian entities or citizens].</p>
<p>On June 20, 2023, Vars_Secc posted a sales thread on the cybercrime forum <strong>Ramp 2.0</strong> titled, &#8220;Selling US Gov Financial Access.&#8221;</p>
<p>&#8220;Server within the network, possible to pivot,&#8221; Vars_Secc&#8217;s sparse sales post read. &#8220;Has 3-5 subroutes connected to it. Price $1,250. Telegram: Vars_Secc.&#8221;</p>
<p>Vars_Secc also used Ramp in June 2023 to sell access to a &#8220;Vietnam government Internet Network Information Center.&#8221;</p>
<p>&#8220;Selling access server allocated within the network,&#8221; Vars_Secc wrote. &#8220;Has some data on it. $500.&#8221;</p>
<h2>BUG BOUNTIES</h2>
<p>The Vars_Secc identity claimed on Telegram in May 2023 that they made money by submitting reports about software flaws to <strong>HackerOne</strong>, a company that helps technology firms field reports about security vulnerabilities in their products and services. Specifically, Vars_Secc said they had earned financial rewards or &#8220;bug bounties&#8221; from <strong>reddit.com</strong>, the <strong>U.S.</strong> <strong>Department of Defense</strong>, and <strong>Coinbase</strong>, among 30 others.</p>
<p>&#8220;I make money off bug bounties, it&#8217;s quite simple,&#8221; Vars_Secc said when asked what they do for a living. &#8220;That&#8217;s why I have over 30 bug bounty reports on HackerOne.&#8221;</p>
<p>A month before that, Vars_Secc said they&#8217;d found a vulnerability in reddit.com.</p>
<p>&#8220;I poisoned Reddit&#8217;s cache,&#8221; they explained. &#8220;I&#8217;m going to exploit it further, then report it to reddit.&#8221;</p>
<p>KrebsOnSecurity sought comment from HackerOne, which said it would investigate the claims. This story will be updated if they respond.</p>
<p>The Vars_Secc telegram handle also has claimed ownership of the BreachForums member &#8220;<strong>Boxfan</strong>,&#8221; and Intel 471 shows Boxfan&#8217;s early posts on the forum had the Vars_Secc Telegram account in their signature. In their most recent post to BreachForums in January 2024, Boxfan disclosed a security vulnerability they found in <strong>Naver</strong>, the most popular search engine in South Korea (according to statista.com). Boxfan&#8217;s comments suggest they have strong negative feelings about South Korean culture.</p>
<p>&#8220;Have fun exploiting this vulnerability,&#8221; Boxfan wrote on BreachForums, after pasting a long string of computer code intended to demonstrate the flaw. &#8220;Fuck you South Korea and your discriminatory views. Nobody likes ur shit kpop you evil fucks. Whoever can dump this DB [database] congrats. I don&#8217;t feel like doing it so I&#8217;ll post it to the forum.&#8221;</p>
<p>The many identities tied to Kiberphant0m strongly suggest they are or until recently were a U.S. Army soldier stationed in South Korea. Kiberphant0m&#8217;s alter egos never mentioned their military rank, regiment, or specialization.</p>
<p>However, it is likely that Kiberphant0m&#8217;s facility with computers and networking was noticed by the Army. According to the U.S. Army&#8217;s website, the bulk of its forces in South Korea reside within the <a href="https://en.wikipedia.org/wiki/Eighth_Army_(United_States)" target="_blank" rel="noopener">Eighth Army</a>, which has a dedicated cyber operations unit focused on defending against cyber threats.</p>
<p>On April 1, 2023, Vars_Secc posted to a public Telegram chat channel a screenshot of the National Security Agency&#8217;s website. The image indicated the visitor had just applied for some type of job at the NSA.</p>
<div id="attachment_69656" style="width: 720px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69656" decoding="async" loading="lazy" class="size-full wp-image-69656" src="media/bd877a9e.kiber-nsa-app.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiber-nsa-app.png" alt="" width="710" height="511" /><p id="caption-attachment-69656" class="wp-caption-text">A screenshot posted by Vars_Secc on Telegram on April 1, 2023, suggesting they just applied for a job at the National Security Agency.</p></div>
<p>The NSA has not yet responded to requests for comment.</p>
<p>Reached via Telegram, Kiberphant0m acknowledged that KrebsOnSecurity managed to unearth their old handles.</p>
<p>&#8220;I see you found the IP behind it no way,&#8221; Kiberphant0m <a href="media/164e69d5.kiber-tg-replies.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiber-tg-replies.png" target="_blank" rel="noopener">replied</a>. &#8220;I see you managed to find my old aliases LOL.&#8221;</p>
<p>Kiberphant0m denied being in the U.S. Army or ever being in South Korea, and said all of that was a lengthy ruse designed to create a fictitious persona. &#8220;Epic opsec troll,&#8221; they claimed.</p>
<p>Asked if they were at all concerned about getting busted, Kiberphant0m called that an impossibility.</p>
<p>&#8220;I literally can&#8217;t get caught,&#8221; Kiberphant0m said, declining an invitation to explain why. &#8220;I don&#8217;t even live in the USA Mr. Krebs.&#8221;</p>
<p>Below is a mind map that hopefully helps illustrate some of the connections between and among Kiberphant0m&#8217;s apparent alter egos.</p>
<div id="attachment_69662" style="width: 1592px" class="wp-caption aligncenter"><a href="media/0c148f2c.kiberphantom-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphantom-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69662" decoding="async" loading="lazy" class="wp-image-69662 size-full" src="media/0c148f2c.kiberphantom-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphantom-mm.png" alt="" width="1582" height="841" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphantom-mm.png 1582w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphantom-mm-768x408.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphantom-mm-1536x817.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphantom-mm-782x416.png 782w" sizes="(max-width: 1582px) 100vw, 1582px" /></a><p id="caption-attachment-69662" class="wp-caption-text">A mind map of the connections between and among the identities apparently used by Kiberphant0m. Click to enlarge.</p></div>
<p>KrebsOnSecurity would like to extend a special note of thanks to the New York City based security intelligence firm <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a> for their assistance in helping to piece together key elements of Kiberphant0m&#8217;s different identities.</p>


feed_id: https://krebsonsecurity.com/?p=69531
title: Why Phishers Love New TLDs Like .shop, .top and .xyz
uri: Why-Phishers-Love-New-TLDs-Like-shop-top-and-xyz
url: https://krebsonsecurity.com/2024/12/why-phishers-love-new-tlds-like-shop-top-and-xyz/
content:
<p>Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) &#8212; such as <strong>.shop</strong>, <strong>.top</strong>, <strong>.xyz</strong> &#8212; that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.</p>
<div id="attachment_68142" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68142" decoding="async" class=" wp-image-68142" src="media/e3077117.phishtrap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishtrap.png" alt="" width="748" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishtrap.png 776w, https://krebsonsecurity.com/wp-content/uploads/2024/07/phishtrap-768x469.png 768w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-68142" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>A <a href="https://interisle.net/insights/phishing-landscape-2024-an-annual-study-of-the-scope-and-distribution-of-phishing" target="_blank" rel="noopener">study</a> on phishing data released by <strong>Interisle Consulting</strong> finds that new gTLDs introduced in the last few years command just 11 percent of the market for new domains, but accounted for roughly 37 percent of cybercrime domains reported between September 2023 and August 2024.</p>
<p>Interisle sources data about cybercrime domains from anti-spam organizations, including the <strong>Anti-Phishing Working Group</strong> (APWG), the <strong>Coalition Against Unsolicited Commercial Email</strong> (CAUCE), and the <strong>Messaging, Malware, and Mobile Anti-Abuse Working Group</strong> (M3AAWG).</p>
<p>The study finds that while <strong>.com</strong> and <strong>.net</strong> domains made up approximately half of all domains registered in the past year (more than all of the other TLDs combined) they accounted for just over 40 percent of all cybercrime domains. Interisle says an almost equal share &#8212; 37 percent &#8212; of cybercrime domains were registered through new gTLDs.</p>
<p>Spammers and scammers gravitate toward domains in the new gTLDs because these registrars tend to offer cheap or free registration with little to no account or identity verification requirements. For example, among the gTLDs with the highest cybercrime domain scores in this year&#8217;s study, nine offered registration fees for less than $1, and nearly two dozen offered fees of less than $2.00. By comparison, the cheapest price identified for a .com domain was $5.91.</p>
<p>Currently, there are around 2,500 registrars authorized to sell domains by the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN), the California nonprofit that oversees the domain industry.</p>
<div id="attachment_69689" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69689" decoding="async" loading="lazy" class=" wp-image-69689" src="media/26e30b1b.interisle-top-xyz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/interisle-top-xyz.png" alt="" width="749" height="503" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/interisle-top-xyz.png 862w, https://krebsonsecurity.com/wp-content/uploads/2024/12/interisle-top-xyz-768x516.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/interisle-top-xyz-782x525.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-69689" class="wp-caption-text">The top 5 new gTLDs, ranked by cybercrime domains reported. Image: Interisle Cybercrime Supply Chain 2014.</p></div>
<p>Incredibly, despite years of these reports showing phishers heavily abusing new gTLDs, ICANN is shuffling forward on a plan to introduce even more of them. ICANN&#8217;s proposed <a href="https://newgtldprogram.icann.org/en/application-rounds/round2" target="_blank" rel="noopener">next round envisions</a> accepting applications for new gTLDs in 2026.</p>
<p><strong>John Levine </strong>is author of the book &#8220;The Internet for Dummies&#8221; and president of CAUCE. Levine said adding more TLDs without a much stricter registration policy will likely further expand an already plentiful greenfield for cybercriminals.</p>
<p>&#8220;The problem is that ICANN can&#8217;t make up their mind whether they are the neutral nonprofit regulator or just the domain speculator trade association,&#8221; Levine told KrebsOnSecurity. &#8220;But they act a lot more like the latter.&#8221;<span id="more-69531"></span></p>
<p>Levine said the vast majority of new gTLDs have a few thousand domains &#8212; a far cry from the number of registrations they would need just to cover the up-front costs of operating a new gTLD (~$180,000-$300,000). New gTLD registrars can quickly attract customers by selling domains cheaply to customers who buy domains in bulk, but that tends to be a losing strategy.</p>
<p>&#8220;Selling to criminals and spammers turns out to be lousy business,&#8221; Levine said. &#8220;You can charge whatever you want on the first year, but you have to charge list price on domain renewals. And criminals and spammers never renew. So if it sounds like the economics makes no sense it&#8217;s because the economics makes no sense.&#8221;</p>
<p>In virtually all previous spam reports, Interisle found the top brands referenced in phishing attacks were the largest technology companies, including Apple, Facebook, Google and PayPal. But this past year, Interisle found the <strong>U.S. Postal Service</strong> was by far the most-phished entity, with more than four times the number of phishing domains as the second most-frequent target (Apple).</p>
<p>At least some of that increase is likely from a prolific cybercriminal using the nickname <strong>Chenlun</strong>, who has been <a href="https://krebsonsecurity.com/2023/10/phishers-spoof-usps-12-other-natl-postal-services/" target="_blank" rel="noopener">selling phishing kits targeting domestic postal services</a> in the United States and at least a dozen other countries.</p>
<p>Interisle says an increasing number of phishers are eschewing domain registrations altogether, and instead taking advantage of subdomain providers like <strong>blogspot.com</strong>, <strong>pages.dev</strong>, and <strong>weebly.com</strong>. The report notes that cyberattacks hosted at subdomain provider services can be tough to mitigate, because only the subdomain provider can disable malicious accounts or take down malicious web pages.</p>
<p>&#8220;Any action upstream, such as blocking the second-level domain, would have an impact across the provider&#8217;s whole customer base,&#8221; the report observes.</p>
<p>Interisle tracked more than 1.18 million instances of subdomains used for phishing in the past year (a 114 percent increase), and found more than half of those were subdomains at blogspot.com and other services operated by Google.</p>
<p>&#8220;Many of these services allow the creation of large numbers of accounts at one time, which is highly exploited by criminals,&#8221; the report concludes. &#8220;Subdomain providers should limit the number of subdomains (user accounts) a customer can create at one time and suspend automated, high-volume automated account sign-ups – especially using free services.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=69698
title: U.S. Offered $10M for Hacker Just Arrested by Russia
uri: U-S-Offered-10M-for-Hacker-Just-Arrested-by-Russia
url: https://krebsonsecurity.com/2024/12/u-s-offered-10m-for-hacker-just-arrested-by-russia/
content:
<p>In January 2022, KrebsOnSecurity identified a Russian man named <strong>Mikhail Matveev</strong> as &#8220;<strong>Wazawaka</strong>,&#8221; a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.</p>
<div id="attachment_63686" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63686" decoding="async" class=" wp-image-63686" src="media/5c483978.fbiwanted-matveev.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png" alt="" width="748" height="734" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png 804w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev-768x754.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev-782x767.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-63686" class="wp-caption-text">An FBI wanted poster for Matveev.</p></div>
<p>Matveev, a.k.a. &#8220;Wazawaka&#8221; and &#8220;<strong>Boriselcin</strong>&#8221; worked with at least three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies, U.S. prosecutors allege.</p>
<p>Russia&#8217;s interior ministry last week issued <a href="https://t.me/mvd39/5931" target="_blank" rel="noopener">a statement</a> saying a 32-year-old hacker had been charged with violating domestic laws against the creation and use of malicious software. The announcement didn&#8217;t name the accused, but the Russian state news agency <em>RIA Novosti</em> <a href="https://ria.ru/20241129/sud-1986456557.html" target="_blank" rel="noopener">cited</a> anonymous sources saying the man detained is Matveev.</p>
<p>Matveev did not respond to requests for comment. <strong>Daryna Antoniuk</strong> at <em>TheRecord</em> <a href="https://therecord.media/wazawaka-mikhail-matveev-reportedly-arrested-russia" target="_blank" rel="noopener">reports</a> that a security researcher said on Sunday they had contacted Wazawaka, who confirmed being charged and said he&#8217;d paid two fines, had his cryptocurrency confiscated, and is currently out on bail pending trial.</p>
<p>Matveev&#8217;s hacker identities were remarkably open and talkative on numerous cybercrime forums. Shortly after <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">being identified as Wazawaka by KrebsOnSecurity in 2022</a>, Matveev <a href="https://krebsonsecurity.com/2022/02/wazawaka-goes-waka-waka/" target="_blank" rel="noopener">published multiple selfie videos on Twitter/X</a> where he acknowledged using the Wazawaka moniker and mentioned several security researchers by name (including this author). More recently, Matveev&#8217;s X profile (@ransomboris) <a href="https://x.com/LucasKatashi/status/1716815224874140121" target="_blank" rel="noopener">posted</a> a picture of a t-shirt that features the U.S. government&#8217;s &#8220;Wanted&#8221; poster for him.</p>
<div id="attachment_69704" style="width: 597px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69704" decoding="async" loading="lazy" class="size-full wp-image-69704" src="media/f9cebd26.matveev-wanted-tshirt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/matveev-wanted-tshirt.png" alt="" width="587" height="815" /><p id="caption-attachment-69704" class="wp-caption-text">An image tweeted by Matveev showing the Justice Department&#8217;s wanted poster for him on a t-shirt. image: x.com/vxunderground</p></div>
<p>The golden rule of cybercrime in Russia has always been that as long as you never hack, extort or steal from Russian citizens or companies, you have little to fear of arrest. Wazawaka claimed he zealously adhered to this rule as a personal and professional mantra.</p>
<p>&#8220;Don&#8217;t shit where you live, travel local, and don&#8217;t go abroad,&#8221; Wazawaka wrote in January 2021 on the Russian-language cybercrime forum Exploit. &#8220;Mother Russia will help you. Love your country, and you will always get away with everything.&#8221;<span id="more-69698"></span></p>
<p>Still, Wazawaka may not have always stuck to that rule. At several points throughout his career, Wazawaka claimed he made good money stealing accounts from drug dealers on darknet narcotics bazaars.</p>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> said Matveev&#8217;s arrest raises more questions than answers, and that Russia&#8217;s motivation here likely goes beyond what&#8217;s happening on the surface.</p>
<p>&#8220;It&#8217;s possible this is a shakedown by Kaliningrad authorities of a local internet thug who has tens of millions of dollars in cryptocurrency,&#8221; Intel 471 wrote in an analysis published Dec. 2. &#8220;The country’s ingrained, institutional corruption dictates that if dues aren’t paid, trouble will come knocking. But it’s usually a problem money can fix.</p>
<p>Intel 471 says while Russia’s court system is opaque, Matveev will likely be open about the proceedings, particularly if he pays a toll and is granted passage to continue his destructive actions.</p>
<p>&#8220;Unfortunately, none of this would mark meaningful progress against ransomware,&#8221; they concluded.</p>
<p>Although Russia traditionally hasn&#8217;t put a lot of effort into going after cybercriminals within its borders, it has brought a series of charges against alleged ransomware actors this year. In January, four men tied to the REvil ransomware group were sentenced to lengthy prison terms. The men were among <a href="https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/" target="_blank" rel="noopener">14 suspected REvil members rounded up by Russia</a> in the weeks before Russia invaded Ukraine in 2022.</p>
<p>Earlier this year, Russian authorities arrested at least two men for allegedly operating the short-lived <strong>Sugarlocker</strong> ransomware program in 2021. <strong>Aleksandr Ermakov</strong> and <strong>Mikhail Shefel</strong> (now legally <strong>Mikhail Lenin</strong>) <a href="https://krebsonsecurity.com/2024/01/who-is-alleged-medibank-hacker-aleksandr-ermakov/" target="_blank" rel="noopener">ran a security consulting business called <strong>Shtazi-IT</strong></a>. Shortly before his arrest, Ermakov became the first ever cybercriminal sanctioned by Australia, which alleged he stole and leaked data on nearly 10 million customers of the Australian health giant Medibank.</p>
<p>In December 2023, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">identified Lenin as &#8220;<strong>Rescator</strong>,&#8221;</a> the nickname used by the cybercriminal responsible for selling more than 100 million payment cards stolen from customers of Target and Home Depot in 2013 and 2014. Last month, Shefel <a href="https://krebsonsecurity.com/2024/11/an-interview-with-the-target-home-depot-hacker/" target="_blank" rel="noopener">admitted in an interview with KrebsOnSecurity</a> that he was Rescator, and claimed his arrest in the Sugarlocker case was payback for reporting the son of his former boss to the police.</p>
<p>Ermakov was sentenced to two years probation. But on the same day my interview with Lenin was published here, a Moscow court declared him insane, and ordered him to undergo compulsory medical treatment, The Record&#8217;s Antoniuk notes.</p>


feed_id: https://krebsonsecurity.com/?p=69721
title: Patch Tuesday, December 2024 Edition
uri: Patch-Tuesday-December-2024-Edition
url: https://krebsonsecurity.com/2024/12/patch-tuesday-december-2024-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug at least 70 security holes in <strong>Windows</strong> and Windows software, including one vulnerability that is already being exploited in active attacks.</p>
<p><img decoding="async" loading="lazy" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The zero-day seeing exploitation involves <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49138" target="_blank" rel="noopener">CVE-2024-49138</a>, a security weakness in the <strong>Windows Common Log File System</strong> (CLFS) driver &#8212; used by applications to write transaction logs &#8212; that could let an authenticated attacker gain &#8220;system&#8221; level privileges on a vulnerable Windows device.</p>
<p>The security firm <strong>Rapid7</strong> notes there have been a series of zero-day elevation of privilege flaws in CLFS over the past few years.</p>
<p>&#8220;Ransomware authors who have abused previous CLFS vulnerabilities will be only too pleased to get their hands on a fresh one,&#8221; wrote <strong>Adam Barnett</strong>, lead software engineer at Rapid7. &#8220;Expect more CLFS zero-day vulnerabilities to emerge in the future, at least until Microsoft performs a full replacement of the aging CLFS codebase instead of offering spot fixes for specific flaws.&#8221;</p>
<p>Elevation of privilege vulnerabilities accounted for 29% of the 1,009 security bugs Microsoft has patched so far in 2024, according to a year-end tally by <strong>Tenable</strong>; nearly 40 percent of those bugs were weaknesses that could let attackers run malicious code on the vulnerable device.<span id="more-69721"></span></p>
<p><strong>Rob Reeves</strong>, principal security engineer at <strong>Immersive Labs</strong>, called special attention to <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49112" target="_blank" rel="noopener">CVE-2024-49112</a>, a remote code execution flaw in the <strong>Lightweight Directory Access Protocol</strong> (LDAP) service <em>on every version of Windows since Windows 7. </em>CVE-2024-49112 has been assigned a CVSS (badness) score of 9.8 out of 10.</p>
<p>&#8220;LDAP is most commonly seen on servers that are Domain Controllers inside a Windows network and LDAP must be exposed to other servers and clients within an enterprise environment for the domain to function,&#8221; Reeves said. &#8220;Microsoft hasn’t released specific information about the vulnerability at present, but has indicated that the attack complexity is low and authentication is not required.&#8221;</p>
<p><strong>Tyler Reguly</strong> at the security firm <strong>Fortra</strong> had a slightly different 2024 patch tally for Microsoft, at 1,088 vulnerabilities, which he said was surprisingly similar to the 1,063 vulnerabilities resolved in 2023 and the 1,119 vulnerabilities resolved in 2022.</p>
<p>&#8220;If nothing else, we can say that Microsoft is consistent,&#8221; Reguly said. &#8220;While it would be nice to see the number of vulnerabilities each year decreasing, at least consistency lets us know what to expect.&#8221;</p>
<p>If you&#8217;re a Windows end user and your system is not set up to automatically install updates, please take a minute this week to run Windows Update, preferably after backing up your system and/or important data.</p>
<p>System admins should keep an eye on <a href="https://www.askwoody.com" target="_blank" rel="noopener">AskWoody.com</a>, which usually has the details if any of the Patch Tuesday fixes are causing problems. In the meantime, if you run into any problems applying this month&#8217;s fixes, please drop a note about in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=69725
title: How Cryptocurrency Turns to Cash in Russian Banks
uri: How-Cryptocurrency-Turns-to-Cash-in-Russian-Banks
url: https://krebsonsecurity.com/2024/12/how-cryptocurrency-turns-to-cash-in-russian-banks/
content:
<p>A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges &#8212; none of which are physically located there.</p>
<p><img decoding="async" class="aligncenter wp-image-69766" src="media/7d39a893.happycanada.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/happycanada.png" alt="" width="650" height="397" /></p>
<p><strong>Richard Sanders</strong> is a blockchain analyst and investigator who advises the law enforcement and intelligence community. Sanders spent most of 2023 in Ukraine, traveling with Ukrainian soldiers while mapping the shifting landscape of Russian crypto exchanges that are laundering money for narcotics networks operating in the region.</p>
<p>More recently, Sanders has focused on identifying how dozens of popular cybercrime services are getting paid by their customers, and how they are converting cryptocurrency revenues into cash. For the past several months, he&#8217;s been signing up for various cybercrime services, and then tracking where their customer funds go from there.</p>
<p>The 122 services targeted in Sanders&#8217; research include some of the more prominent businesses advertising on the cybercrime forums today, such as:</p>
<p>-abuse-friendly or &#8220;bulletproof&#8221; hosting providers like anonvm[.]wtf, and <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">PQHosting</a>;<br />
-sites selling aged email, financial, or social media accounts, such as verif[.]work and <a href="https://krebsonsecurity.com/2023/06/service-rents-email-addresses-for-account-signups/" target="_blank" rel="noopener">kopeechka[.]store</a>;<br />
-anonymity or &#8220;proxy&#8221; providers like crazyrdp[.]com and rdp[.]monster;<br />
-anonymous SMS services, including anonsim[.]net and smsboss[.]pro.</p>
<div id="attachment_69768" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69768" decoding="async" loading="lazy" class=" wp-image-69768" src="media/b2ff8932.verif-work.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/verif-work.png" alt="" width="748" height="462" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/verif-work.png 1253w, https://krebsonsecurity.com/wp-content/uploads/2024/12/verif-work-768x474.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/verif-work-782x483.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-69768" class="wp-caption-text">The site Verif dot work, which processes payments through Cryptomus, sells financial accounts, including debit and credit cards.</p></div>
<p>Sanders said he first encountered some of these services while investigating Kremlin-funded disinformation efforts in Ukraine, as they are all useful in assembling large-scale, anonymous social media campaigns.</p>
<p>According to Sanders, all 122 of the services he tested are processing transactions through a company called <strong>Cryptomus</strong>, which says it is a cryptocurrency payments platform based in Vancouver, British Columbia. Cryptomus&#8217; website says its parent firm &#8212; <strong>Xeltox Enterprises Ltd. </strong>(formerly certa-pay[.]com) &#8212; is registered as a money service business (MSB) with the <strong>Financial Transactions and Reports Analysis Centre of Canada</strong> (FINTRAC).</p>
<p>Sanders said the payment data he gathered also shows that at least 56 cryptocurrency exchanges are currently using Cryptomus to process transactions, including financial entities with names like <strong>casher[.]su</strong>, <strong>grumbot[.]com</strong>, <strong>flymoney[.]biz, obama[.]ru</strong> and <strong>swop[.]is</strong>.</p>
<p>These platforms are built for Russian speakers, and they each advertise the ability to anonymously swap one form of cryptocurrency for another. They also allow the exchange of cryptocurrency for cash in accounts at some of Russia&#8217;s largest banks &#8212; <em>nearly all of which are currently sanctioned by the United States and other western nations</em>.</p>
<div id="attachment_69745" style="width: 761px" class="wp-caption aligncenter"><a href="media/de2570e8.flymoney.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/flymoney.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69745" decoding="async" loading="lazy" class="wp-image-69745" src="media/de2570e8.flymoney.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/flymoney.png" alt="" width="751" height="430" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/flymoney.png 1399w, https://krebsonsecurity.com/wp-content/uploads/2024/12/flymoney-768x440.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/flymoney-782x448.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-69745" class="wp-caption-text">A machine-translated version of Flymoney, one of dozens of cryptocurrency exchanges apparently nested at Cryptomus.</p></div>
<p>An analysis of their technology infrastructure shows that all of these exchanges use Russian email providers, and most are directly hosted in Russia or by Russia-backed ISPs with infrastructure in Europe (e.g. Selectel, Netwarm UK, Beget, Timeweb and DDoS-Guard). The analysis also showed nearly all 56 exchanges used services from <strong>Cloudflare</strong>, a global content delivery network based in San Francisco.</p>
<p>&#8220;Purportedly, the purpose of these platforms is for companies to accept cryptocurrency payments in exchange for goods or services,&#8221; Sanders told KrebsOnSecurity. &#8220;Unfortunately, it is next to impossible to find any goods for sale with websites using Cryptomus, and the services appear to fall into one or two different categories: Facilitating transactions with sanctioned Russian banks, and platforms providing the infrastructure and means for cyber attacks.&#8221;</p>
<p>Cryptomus did not respond to multiple requests for comment.</p>
<h2>PHANTOM ADDRESSES?</h2>
<p>The Cryptomus website and its FINTRAC listing say the company&#8217;s registered address is <strong>Suite 170, 422 Richards St. in Vancouver, BC.</strong> This address was the subject of <a href="https://theijf.org/msb-cluster-investigation" target="_blank" rel="noopener">an investigation published in July</a> by <strong>CTV National News </strong>and the <strong>Investigative Journalism Foundation (IJF)</strong>, which documented dozens of cases across Canada where multiple MSBs are incorporated at the same address, often without the knowledge or consent of the location&#8217;s actual occupant.</p>
<div id="attachment_69744" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69744" decoding="async" loading="lazy" class=" wp-image-69744" src="media/a5052c06.ijf-ctv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/ijf-ctv.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/ijf-ctv.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2024/12/ijf-ctv-768x509.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/ijf-ctv-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-69744" class="wp-caption-text">This building at 422 Richards St. in downtown Vancouver is the registered address for 90 money services businesses, including 10 that have had their registrations revoked. Image: theijf.org/msb-cluster-investigation.</p></div>
<p>Their inquiry found 422 Richards St. was listed as the registered address for at least 76 foreign currency dealers, eight MSBs, and six cryptocurrency exchanges. At that address is a three-story building that used to be a bank and now houses a massage therapy clinic and a co-working space. But they found none of the MSBs or currency dealers were paying for services at that co-working space.</p>
<p>The reporters found another collection of 97 MSBs clustered at an address for a commercial office suite in Ontario, even though there was no evidence these companies had ever arranged for any business services at that address.</p>
<p><strong>Peter German</strong>, a former deputy commissioner for the <strong>Royal Canadian Mounted Police</strong> who authored two reports on money laundering in British Columbia, told the publications it goes against the spirit of Canada’s registration requirements for such businesses, which are considered high-risk for money laundering and terrorist financing.</p>
<p>“If you’re able to have 70 in one building, that’s just an abuse of the whole system,” German said.</p>
<p>Ten MSBs registered to 422 Richard St. had their registrations revoked. One company at 422 Richards St. whose registration was revoked this year had a director with a listed address in Russia, the publications reported. &#8220;Others appear to be directed by people who are also directors of companies in Cyprus and other high-risk jurisdictions for money laundering,&#8221; they wrote.</p>
<p>A review of <a href="https://krebsonsecurity.com/wp-content/uploads/2024/12/fintrac-msbs.csv" target="_blank" rel="noopener">FINTRAC&#8217;s registry</a> (.CSV) shows many of the MSBs at 422 Richards St. are international money transfer or remittance services to countries like Malaysia, India and Nigeria. Some act as currency exchanges, while others appear to sell merchant accounts and online payment services. Still, KrebsOnSecurity could find no obvious connections between the 56 Russian cryptocurrency exchanges identified by Sanders and the dozens of payment companies that FINTRAC says share an address with the Cryptomus parent firm Xeltox Enterprises.<span id="more-69725"></span></p>
<h2>SANCTIONS EVASION</h2>
<p>In August 2023, <strong>Binance</strong> and some of the largest cryptocurrency exchanges responded to sanctions against Russia by <a href="https://www.wsj.com/finance/binance-cryptocurrency-russia-sanctions-ddb948c3?mod=e2tw" target="_blank" rel="noopener">cutting off many Russian banks</a> and restricting Russian customers to transactions in Rubles only. Sanders said prior to that change, most of the exchanges currently served by Cryptomus were handling customer funds with their own self-custodial cryptocurrency wallets.</p>
<p>By September 2023, Sanders said he found the exchanges he was tracking had all nested themselves like Matryoshka dolls at Cryptomus, which adds a layer of obfuscation to all transactions by generating a new cryptocurrency wallet for each order.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-69800" src="media/c821d389.matrydolls.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/matrydolls.png" alt="" width="638" height="306" /></p>
<p>&#8220;They all simply moved to Cryptomus,&#8221; he said. &#8220;Cryptomus generates new wallets for each order, rendering ongoing attribution to require transactions with high fees each time.&#8221;</p>
<p>&#8220;Exchanges like Binance and OKX removing Sberbank and other sanctioned banks and offboarding Russian users did not remove the ability of Russians to transact in and out of cryptocurrency easily,&#8221; he continued. &#8220;In fact, it’s become easier, because the instant-swap exchanges do not even have Know Your Customer rules. The U.S. sanctions resulted in the majority of Russian instant exchanges switching from their self-custodial wallets to platforms, especially Cryptomus.&#8221;</p>
<p>Russian President Vladimir Putin in August signed a new law legalizing cryptocurrency mining and allowing the use of cryptocurrency for international payments. The Russian government&#8217;s embrace of cryptocurrency was a remarkable pivot: Bloomberg <a href="https://www.bloomberg.com/news/articles/2024-08-26/russia-close-to-starting-trials-of-crypto-payments-exchanges" target="_blank" rel="noopener">notes</a> that as recently as January 2022, just weeks before Russia&#8217;s full-scale invasion of Ukraine, the central bank proposed a blanket ban on the use and creation of cryptocurrencies.</p>
<p>In a report on Russia&#8217;s cryptocurrency ambitions published in September, blockchain analysis firm <strong>Chainalysis</strong> said Russia’s move to integrate crypto into its financial system may improve its ability to bypass the U.S.-led financial system and to engage in non-dollar denominated trade.</p>
<p>&#8220;Although it can be hard to quantify the true impact of certain sanctions actions, the fact that Russian officials have singled out the effect of sanctions on Moscow’s ability to process cross-border trade suggests that the impact felt is great enough to incite urgency to legitimize and invest in alternative payment channels it once decried,&#8221; Chainalysis <a href="https://www.chainalysis.com/blog/russias-cryptocurrency-legislated-sanctions-evasion/" target="_blank" rel="noopener">assessed</a>.</p>
<p>Asked about its view of activity on Cryptomus, Chainanlysis said Cryptomus has been used by criminals of all stripes for laundering money and/or the purchase of goods and services.</p>
<p>&#8220;We see threat actors engaged in ransomware, narcotics, darknet markets, fraud, cybercrime, sanctioned entities and jurisdictions, and hacktivism making deposits to Cryptomus for purchases but also laundering the services using Cryptomos payment API,&#8221; the company said in a statement.</p>
<h2>SHELL GAMES</h2>
<p>It is unclear if Cryptomus and/or Xeltox Enterprises have any presence in Canada at all. A search in the United Kingdom&#8217;s Companies House registry for Xeltox&#8217;s former name &#8212; Certa Payments Ltd. &#8212; shows <a href="https://find-and-update.company-information.service.gov.uk/officers/i3FM6G1i2Mptkatjb4YtUXkWL4Y/appointments" target="_blank" rel="noopener">an entity by that name</a> incorporated at a mail drop in London in December 2023.</p>
<p>The sole shareholder and director of that company is listed as a 25-year-old Ukrainian woman in the Czech Republic named <strong>Vira Krychka</strong>. Ms. Krychka was recently appointed the director of <a href="https://find-and-update.company-information.service.gov.uk/search/officers?q=vera%20krychka" target="_blank" rel="noopener">several other new U.K. firms</a>, including an entity created in February 2024 called <a href="https://find-and-update.company-information.service.gov.uk/company/15493736/persons-with-significant-control" target="_blank" rel="noopener">Globopay UAB Ltd</a>, and another called <strong>WS Management and Advisory Corporation Ltd. </strong>Ms. Krychka did not respond to a request for comment.</p>
<p><a href="https://find-and-update.company-information.service.gov.uk/officers/E_cO2EzffYsXeXBK5-WF6P5_cLY/appointments" target="_blank" rel="noopener">WS Management and Advisory Corporation</a> bills itself as the regulatory body that exclusively oversees licenses of cryptocurrencies in the jurisdiction of <a href="https://en.wikipedia.org/wiki/Western_Sahara" target="_blank" rel="noopener">Western Sahara</a>, a disputed territory in northwest Africa. Its website says the company assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments&#8217; former websites &#8212; certa[.]website &#8212; also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.</p>
<div id="attachment_69802" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69802" decoding="async" loading="lazy" class=" wp-image-69802" src="media/80b3e040.crasadr-com.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/crasadr-com.png" alt="" width="748" height="423" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/crasadr-com.png 1490w, https://krebsonsecurity.com/wp-content/uploads/2024/12/crasadr-com-768x435.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/crasadr-com-782x442.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-69802" class="wp-caption-text">The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara.</p></div>
<p><a href="https://rejstrik-firem.kurzy.cz/osoba/3569774/" target="_blank" rel="noopener">This business registry</a> from the Czech Republic indicates Ms. Krychka works as a director at an advertising and marketing firm called <strong>Icon Tech SRO</strong>, which was previously named <strong>Blaven Technologies</strong> (Blaven&#8217;s website says it is an online payment service provider).</p>
<p>In August 2024, Icon Tech changed its name again to <strong>Mezhundarondnaya IBU SRO</strong>, which describes itself as an &#8220;experienced company in IT consulting&#8221; that is based in Armenia. The same registry says Ms. Krychka is somehow also a director at a Turkish investment venture. So much business acumen at such a young age!</p>
<p>For now, Canada remains an attractive location for cryptocurrency businesses to set up shop, at least on paper. The IJF and CTV News found that as of February 2024, there were just over 3,000 actively registered MSBs in Canada, 1,247 of which were located at the same building as at least one other MSB.</p>
<p>&#8220;That analysis does not include the roughly 2,700 MSBs whose registrations have lapsed, been revoked or otherwise stopped,&#8221; they observed. &#8220;If they are included, then a staggering 2,061 out of 5,705 total MSBs share a building with at least one other MSB.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=69474
title: How to Lose a Fortune with Just One Bad Click
uri: How-to-Lose-a-Fortune-with-Just-One-Bad-Click
url: https://krebsonsecurity.com/2024/12/how-to-lose-a-fortune-with-just-one-bad-click/
content:
<div id="attachment_69859" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69859" decoding="async" class=" wp-image-69859" src="media/3dc2a3bb.thumb-mobile.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/thumb-mobile.png" alt="" width="749" height="441" /><p id="caption-attachment-69859" class="wp-caption-text">Image: Shutterstock, iHaMoo.</p></div>
<p><strong>Adam Griffin</strong> is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real <strong>Google</strong> phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click &#8220;yes&#8221; to a Google prompt on his mobile device.</p>
<p>Griffin is a battalion chief firefighter in the Seattle area, and on May 6 he received a call from someone claiming they were from Google support saying his account was being accessed from Germany. A Google search on the phone number calling him &#8212; <strong>(650) 203-0000</strong> &#8212; revealed it was an official number for <a href="https://en.wikipedia.org/wiki/Google_Assistant" target="_blank" rel="noopener">Google Assistant</a>, an AI-based service that can engage in two-way conversations.</p>
<p>At the same time, he received an email that came from a google.com email address, warning his Google account was compromised. The message included a &#8220;Google Support Case ID number&#8221; and information about the Google representative supposedly talking to him on the phone, stating the rep&#8217;s name as &#8220;Ashton&#8221;<strong> </strong>&#8212; the same name given by the caller.</p>
<p>Griffin didn&#8217;t learn this until much later, but the email he received had a real google.com address because it was sent via <a href="https://en.wikipedia.org/wiki/Google_Forms" target="_blank" rel="noopener">Google Forms</a>, a service available to all <strong>Google Docs</strong> users that makes it easy to send surveys, quizzes and other communications.</p>
<div id="attachment_69865" style="width: 499px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69865" decoding="async" loading="lazy" class=" wp-image-69865" src="media/6277b871.gsid19472345.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/gsid19472345.png" alt="" width="489" height="833" /><p id="caption-attachment-69865" class="wp-caption-text">A phony security alert Griffin received prior to his bitcoin heist, via Google Forms.</p></div>
<p>According to tripwire.com&#8217;s <strong>Graham Cluely</strong>, phishers will use Google Forms to create a security alert message, and then change the form&#8217;s settings to automatically send a copy of the completed form to any email address entered into the form. The attacker then sends an invitation to complete the form to themselves, not to their intended victim.</p>
<p>&#8220;So, the attacker receives the invitation to fill out the form &#8211; and when they complete it, they enter their intended victim&#8217;s email address into the form, not their own,&#8221; Cluely <a href="https://www.tripwire.com/state-of-security/google-forms-used-call-back-phishing-scam" target="_blank" rel="noopener">wrote in a December 2023 post</a>. &#8220;The attackers are taking advantage of the fact that the emails are being sent out directly by Google Forms (from the google.com domain). It&#8217;s an established legitimate domain that helps to make the email look more legitimate and is less likely to be intercepted en route by email-filtering solutions.&#8221;</p>
<p>The fake Google representative was polite, patient, professional and reassuring. Ashton told Griffin he was going to receive a notification that would allow him to regain control of the account from the hackers. Sure enough, a Google prompt instantly appeared on his phone asking, &#8220;Is it you trying to recover your account?&#8221;</p>
<div id="attachment_69818" style="width: 520px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69818" decoding="async" loading="lazy" class="size-full wp-image-69818" src="media/d2ce11ab.griffin-gar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/griffin-gar.png" alt="" width="510" height="889" /><p id="caption-attachment-69818" class="wp-caption-text">Adam Griffin clicked &#8220;yes,&#8221; to an account recovery notification similar to this one on May 6.</p></div>
<p>Griffin said that after receiving the pop-up prompt from Google on his phone, he felt more at ease that he really was talking to someone at Google. In reality, the thieves caused the alert to appear on his phone merely by stepping through Google&#8217;s account recovery process for Griffin&#8217;s Gmail address.</p>
<p>&#8220;As soon as I clicked yes, I gave them access to my Gmail, which was synched to <strong>Google Photos</strong>,&#8221; Griffin said.</p>
<p>Unfortunately for Griffin, years ago he used Google Photos to store an image of the secret seed phrase that was protecting his cryptocurrency wallet. Armed with that phrase, the phishers could drain all of his funds.</p>
<p>&#8220;From there they were able to transfer approximately $450,000 out of my Exodus wallet,&#8221; Griffin recalled.</p>
<p>Griffin said just minutes after giving away access to his Gmail account he received a call from someone claiming to be with Coinbase, who likewise told him someone in Germany was trying to take over his account.</p>
<p>Griffin said a follow-up investigation revealed the attackers had used his Gmail account to gain access to his Coinbase account from a VPN connection in California, providing the multi-factor code from his Google Authenticator app. Unbeknownst to him at the time, Google Authenticator by default also makes the same codes available in one&#8217;s Google account online.</p>
<p>But when the thieves tried to move $100,000 worth of cryptocurrency out of his account, Coinbase sent an email stating that the account had been locked, and that he would have to submit additional verification documents before he could do anything with it.<span id="more-69474"></span></p>
<h2>GRAND THEFT AUTOMATED</h2>
<p>Just days after Griffin was robbed, a scammer impersonating Google managed to phish 45 bitcoins &#8212; approximately $4,725,000 at today&#8217;s value &#8212; from <strong>Tony</strong>, a 42-year-old professional from northern California. Tony agreed to speak about his harrowing experience on condition that his last name not be used.</p>
<p>Tony got into bitcoin back in 2013 and has been investing in it ever since. On the evening of May 15, 2024, Tony was putting his three- and one-year-old boys to bed when he received a message from Google about an account security issue, followed by a phone call from a &#8220;Daniel Alexander&#8221; at Google who said his account was compromised by hackers.</p>
<p>Tony said he had just signed up for Google&#8217;s <strong>Gemini AI</strong> (an artificial intelligence platform formerly known as &#8220;Bard&#8221;), and mistakenly believed the call was part of that service. Daniel told Tony his account was being accessed by someone in Frankfurt, Germany, and that he could evict the hacker and recover access to the account by clicking &#8220;yes&#8221; to the prompt that Google was going to send to his phone.</p>
<p>The Google prompt arrived seconds later. And to his everlasting regret, Tony clicked the &#8220;Yes, it&#8217;s me&#8221; button.</p>
<p>Then came another call, this one allegedly from security personnel at <strong>Trezor</strong>, a company that makes encrypted hardware devices made to store cryptocurrency seed phrases securely offline. The caller said someone had submitted a request to Trezor to close his account, and they forwarded Tony a message sent from his Gmail account that included his name, Social Security number, date of birth, address, phone number and email address.</p>
<p>Tony said he began to believe then that his Trezor account truly was compromised. The caller convinced him to &#8220;recover&#8221; his account by entering his cryptocurrency seed phrase at a phishing website (<strong>verify-trezor[.]io</strong>) that mimicked the official Trezor website.</p>
<p>&#8220;At this point I go into fight or flight mode,&#8221; Tony recalled. &#8220;I&#8217;ve got my kids crying, my wife is like what the heck is going on? My brain went haywire. I put my seed phrase into a phishing site, and that was it.&#8221;</p>
<p>Almost immediately, all of the funds he was planning to save for retirement and for his children&#8217;s college fund were drained from his account.</p>
<p>&#8220;I made mistakes due to being so busy and not thinking correctly,&#8221; Tony told KrebsOnSecurity. &#8220;I had gotten so far away from the security protocols in bitcoin as life had changed so much since having kids.&#8221;</p>
<div id="attachment_69821" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69821" decoding="async" loading="lazy" class=" wp-image-69821" src="media/db078a0e.tony-text.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-text.png" alt="" width="747" height="540" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-text.png 867w, https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-text-768x555.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-text-782x565.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-69821" class="wp-caption-text">Tony shared this text message exchange of him pleading with his tormentors after being robbed of 45 bitcoins.</p></div>
<p>Tony said the theft left him traumatized and angry for months.</p>
<p>&#8220;All I was thinking about was protecting my boys and it ended up costing me everything,&#8221; he said. &#8220;Needless to say I&#8217;m devastated and have had to do serious therapy to get through it.&#8221;</p>
<h2>MISERY LOVES COMPANY</h2>
<p>Tony told KrebsOnSecurity that in the weeks following the theft of his 45 bitcoins, he became so consumed with rage and shame that he was seriously contemplating suicide. Then one day, while scouring the Internet for signs that others may have been phished by Daniel, he encountered Griffin posting on Reddit about the phone number involved in his recent bitcoin theft.</p>
<p>Griffin said the two of them were initially suspicious of each other &#8212; exchanging cautious messages for about a week &#8212; but he decided Tony was telling the truth after contacting the FBI agent that Tony said was working his case. Comparing notes, they discovered the fake Google security alerts they received just prior to their individual bitcoin thefts referenced the same phony &#8220;Google Support Case ID&#8221; number.</p>
<div id="attachment_69819" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69819" decoding="async" loading="lazy" class=" wp-image-69819" src="media/d0e4314f.tony-gar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-gar.png" alt="" width="750" height="618" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-gar.png 828w, https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-gar-768x633.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/tony-gar-782x644.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69819" class="wp-caption-text">Adam Griffin and Tony said they received the same Google Support Case ID number in advance of their thefts. Both were sent via Google Forms, which sends directly from the google.com domain name.</p></div>
<p>More importantly, Tony recognized the voice of &#8220;Daniel from Google&#8221; when it was featured in an interview by <strong>Junseth</strong>, a podcaster who covers cryptocurrency scams. The same voice that had coaxed Tony out of his considerable cryptocurrency holdings just days earlier also had tried to phish Junseth, who played along for several minutes before revealing he knew it was a scam.</p>
<p>Daniel told Junseth he was a teenager and worked with other scam callers who had all met years ago on the game <strong>Minecraft</strong>, and that he recently enjoyed a run of back-to-back Gmail account compromises that led to crypto theft paydays.</p>
<p>&#8220;No one gets arrested,&#8221; Daniel enthused to Junseth in the May 7 podcast, which quickly went viral on social media. &#8220;It&#8217;s almost like there&#8217;s no consequences. I have small legal side hustles, like businesses and shit that I can funnel everything through. If you were to see me in real life, I look like a regular child going to school with my backpack and shit, you’d never expect this kid is stealing all this shit.&#8221;</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/NmsAk3kXdz4?si=aJKlS76K2FyPXfaj" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Daniel explained that they often use an automated bot that initiates calls to targets warning that their account is experiencing suspicious activity, and that they should press &#8220;1&#8221; to speak with a representative. This process, he explained, essentially self-selects people who are more likely to be susceptible to their social engineering schemes. [It is possible &#8212; but not certain &#8212; that this bot Daniel referenced explains the incoming call to Griffin from Google Assistant that precipitated his bitcoin heist].</p>
<p>Daniel told Junseth he and his co-conspirators had just scored a $1.2 million theft that was still pending on the bitcoin investment platform SwanBitcoin. In response, Junseth <a href="https://x.com/verysmallclaims/status/1787950799202468147" target="_blank" rel="noopener">tagged SwanBitcoin in a post about his podcast on Twitter/X</a>, and the CEO of Swan quickly <a href="https://x.com/coryklippsten/status/1787983800389308465" target="_blank" rel="noopener">replied</a> that they caught the $1.2 million transaction that morning.</p>
<p>Apparently, Daniel didn&#8217;t appreciate having his voice broadcast to the world (or his $1.2 million bitcoin heist disrupted) because according to Junseth someone <a href="https://x.com/verysmallclaims/status/1789831026228830280?s=42&amp;t=XLXvAHsqR5zw7RYKGaM_-g" target="_blank" rel="noopener">submitted a baseless copyright infringement claim</a> about it to Soundcloud, which was hosting the recording.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-69820" src="media/01b91d12.swann-dickarson.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/swann-dickarson.png" alt="" width="592" height="373" /></p>
<p>The complaint alleged the recording included a copyrighted song, but that wasn&#8217;t true: Junseth later posted a raw version of the recording to Telegram, and it clearly had no music in the background. Nevertheless, Soundcloud removed the audio file.</p>
<p>&#8220;All these companies are very afraid of copyright,&#8221; Junseth explained in a May 2024 <a href="https://www.youtube.com/watch?v=NmsAk3kXdz4" target="_blank" rel="noopener">interview with the podcast whatbitcoindid.com</a>, which features some of the highlights from his recorded call with Daniel.</p>
<p>&#8220;It&#8217;s interesting because copyright infringement really is an act that you&#8217;re claiming against the publisher, but for some reason these companies have taken a very hard line against it, so if you even claim there&#8217;s copyrighted material in it they just take it down and then they leave it to you to prove that you&#8217;re innocent,&#8221; Junseth said. &#8220;In Soundcloud&#8217;s instance, part of declaring your innocence is you have to give them your home address and everything else, and it says right on there, &#8216;this will be provided to the person making the copyright claim.'&#8221;</p>
<h2>AFTERMATH</h2>
<p>When Junseth asked how potential victims could protect themselves, Daniel explained that if the target doesn’t have their Google Authenticator synced to their Google cloud account, the scammers can&#8217;t easily pivot into the victim&#8217;s accounts at cryptocurrency exchanges, as they did with Griffin.</p>
<p>By default, Google Authenticator syncs all one-time codes with a Gmail user&#8217;s account, meaning if someone gains access to your Google account, they can then access all of the one-time codes handed out by your Google Authenticator app.</p>
<p>To change this setting, open Authenticator on your mobile device, select your profile picture, and then choose &#8220;Use without an Account&#8221; from the menu. If you disable this, it&#8217;s a good idea to keep <a href="https://support.google.com/accounts/answer/1187538?hl=en&amp;co=GENIE.Platform%3DDesktop" target="_blank" rel="noopener">a printed copy of one-time backup codes</a>, and to store those in a secure place.</p>
<p>You may also wish to download Google Authenticator to another mobile device that you control. Otherwise, if you turn off cloud synching and lose that sole mobile device with your Google Authenticator app, it could be difficult or impossible to recover access to your account if you somehow get locked out.</p>
<p>Griffin told KrebsOnSecurity he had no idea it was so easy for thieves to take over his account, and to abuse so many different Google services in the process.</p>
<p>&#8220;I know I definitely made mistakes, but I also know Google could do a lot better job protecting people,&#8221; he said.</p>
<p>In response to questions from KrebsOnSecurity, Google said it can confirm that this was a narrow phishing campaign, reaching a &#8220;very small group of people.&#8221;</p>
<p>&#8220;We&#8217;re aware of this narrow and targeted attack, and have hardened our defenses to block recovery attempts from this actor,&#8221; the company said in a written statement, which emphasized that the real Google will never call you.</p>
<p>&#8220;While these types of social engineering campaigns are constantly evolving, we are continuously working to harden our systems with new tools and technical innovations, as well as sharing <a href="https://blog.google/technology/safety-security/how-to-spot-scams-and-what-to-do-if-you-encounter-one/#intro" target="_blank" rel="noopener">updated guidance</a> with our users to stay ahead of attackers,&#8221; the statement reads.</p>
<p>Both Griffin and Tony say they continue to receive &#8220;account security&#8221; calls from people pretending to work for Google or one of the cryptocurrency platforms.</p>
<p>&#8220;It&#8217;s like you get put on some kind of list, and then those lists get recycled over and over,&#8221; Tony said.</p>
<p>Griffin said that for several months after his ordeal, he accepted almost every cryptocurrency scam call that came his way, playing along in the vain hope of somehow tricking the caller into revealing details about who they are in real life. But he stopped after his taunting caused one of the scammers to start threatening him personally.</p>
<p>&#8220;I probably shouldn&#8217;t have, but I recorded two 30-minute conversations with these guys,&#8221; Griffin said, acknowledging that maybe it wasn&#8217;t such a great idea to antagonize cybercriminals who clearly already knew everything about him. &#8220;One guy I talked to about his personal life, and then his friend called me up and said he was going to dox me and do all this other bad stuff. My FBI contact later told me not to talk to these guys anymore.&#8221;</p>
<p>Sound advice. So is hanging up whenever anyone calls you about a security problem with one of your accounts. Even security-conscious people tend to underestimate the complex and shifting threat from phone-based phishing scams, but they do so at their peril.</p>
<p>When in doubt: <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">Hang up, look up, and call back</a>. If your response to these types of calls involves anything other than hanging up, researching the correct phone number, and contacting the entity that claims to be calling, you may be setting yourself up for a costly and humbling learning experience.</p>
<p>Understand that your email credentials <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">are more than likely the key to unlocking your entire digital identity</a>. Be sure to use a long, unique passphrase for your email address, and never pick a passphrase that you have ever used anywhere else (not even a variation on an old password).</p>
<p>Finally, it&#8217;s also a good idea to take advantage of the strongest multi-factor authentication methods offered. For Gmail/Google accounts, that includes <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">the use of passkeys or physical security keys</a>, which are heavily phishing resistant. For Google users holding measurable sums of cryptocurrency, the most secure option is Google&#8217;s free <a href="https://landing.google.com/advancedprotection/" target="_blank" rel="noopener">Advanced Protection</a> program, which includes more extensive account security features but also comes <a href="https://www.wired.com/story/google-advanced-protection/" target="_blank" rel="noopener">with some serious convenience trade-offs</a>.</p>


feed_id: https://krebsonsecurity.com/?p=69811
title: Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm
uri: Web-Hacking-Service-Araneida-Tied-to-Turkish-IT-Firm
url: https://krebsonsecurity.com/2024/12/web-hacking-service-araneida-tied-to-turkish-it-firm/
content:
<p>Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of <strong>Acunetix</strong>, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology firm based in Turkey.</p>
<div id="attachment_69895" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69895" decoding="async" class=" wp-image-69895" src="media/a0ad63ed.araneida-scanner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/araneida-scanner.png" alt="" width="749" height="562" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/araneida-scanner.png 1126w, https://krebsonsecurity.com/wp-content/uploads/2024/12/araneida-scanner-768x576.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/araneida-scanner-782x587.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-69895" class="wp-caption-text">Araneida Scanner.</p></div>
<p>Cyber threat analysts at <strong>Silent Push</strong> said they recently received reports from a partner organization that identified an aggressive scanning effort against their website using an Internet address previously associated with a campaign by <a href="https://resources.prodaft.com/fin7-cybercrime-gang" target="_blank" rel="noopener">FIN7</a>, a notorious Russia-based hacking group.</p>
<p>But on closer inspection they discovered the address contained an HTML title of &#8220;<strong>Araneida Customer Panel</strong>,&#8221; and found they could search on that text string to find dozens of unique addresses hosting the same service.</p>
<p>It soon became apparent that Araneida was being resold as a cloud-based service using a cracked version of Acunetix, allowing paying customers to conduct offensive reconnaissance on potential target websites, scrape user data, and find vulnerabilities for exploitation.</p>
<p>Silent Push also learned Araneida bundles its service with a robust proxy offering, so that customer scans appear to come from Internet addresses that are randomly selected from a large pool of available traffic relays.</p>
<p>The makers of Acunetix, Texas-based application security vendor <strong>Invicti Security</strong>, confirmed Silent Push&#8217;s findings, saying someone had figured out how to crack the free trial version of the software so that it runs without a valid license key.</p>
<p>&#8220;We have been playing cat and mouse for a while with these guys,&#8221; said <strong>Matt Sciberras</strong>, chief information security officer at Invicti.</p>
<p>Silent Push said Araneida is being advertised by an eponymous user on multiple cybercrime forums. The service&#8217;s Telegram channel boasts nearly 500 subscribers and explains how to use the tool for malicious purposes.</p>
<p>In a &#8220;Fun Facts&#8221; list posted to the channel in late September, Araneida said their service was used to take over more than 30,000 websites in just six months, and that one customer used it to buy a Porsche with the payment card data (&#8220;dumps&#8221;) they sold.</p>
<div id="attachment_69898" style="width: 668px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69898" decoding="async" loading="lazy" class=" wp-image-69898" src="media/9b9b1355.araneida-tg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/araneida-tg.png" alt="" width="658" height="273" /><p id="caption-attachment-69898" class="wp-caption-text">Araneida Scanner&#8217;s Telegram channel bragging about how customers are using the service for cybercrime.</p></div>
<p>“They are constantly bragging with their community about the crimes that are being committed, how it’s making criminals money,” said <strong>Zach Edwards</strong>, a senior threat researcher at Silent Push. “They are also selling bulk data and dumps which appear to have been acquired with this tool or due to vulnerabilities found with the tool.”</p>
<p>Silent Push also found a cracked version of Acunetix was powering at least 20 instances of a similar cloud-based vulnerability testing service catering to Mandarin speakers, but they were unable to find any apparently related sales threads about them on the dark web.</p>
<p>Rumors of a cracked version of Acunetix being used by attackers surfaced <a href="https://x.com/FalconFeedsio/status/1665690661377691649" target="_blank" rel="noopener">in June 2023 on Twitter/X</a>, when researchers <a href="https://x.com/TLP_R3D/status/1665777020767293447" target="_blank" rel="noopener">first posited a connection between observed scanning activity and Araneida</a>.</p>
<p>According to <a href="media/55d0897e.china-based-threat-actor-profiles-tlpclear.pdf" data-original-source="https://www.hhs.gov/sites/default/files/china-based-threat-actor-profiles-tlpclear.pdf" target="_blank" rel="noopener">an August 2023 report</a> (PDF) from the <strong>U.S. Department of Health and Human Services</strong> (HHS), Acunetix (presumably a cracked version) is among several tools used by <a href="https://krebsonsecurity.com/2020/09/chinese-antivirus-firm-was-part-of-apt41-supply-chain-attack/" target="_blank" rel="noopener">APT 41</a>, a prolific Chinese state-sponsored hacking group.<span id="more-69811"></span></p>
<h2>THE TURKISH CONNECTION</h2>
<p>Silent Push notes that the website where Araneida is being sold &#8212; <strong>araneida[.]co</strong> &#8212; first came online in February 2023. But a review of this Araneida nickname on the cybercrime forums shows they have been active in the criminal hacking scene since at least 2018.</p>
<p>A search in the threat intelligence platform <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> shows a user by the name Araneida promoted the scanner on two cybercrime forums since 2022, including <strong>Breached</strong> and <strong>Nulled</strong>. In 2022, Araneida told fellow Breached members they could be reached on Discord at the username &#8220;<strong>Ornie#9811</strong>.&#8221;</p>
<p>According to Intel 471, this same Discord account was advertised in 2019 by a person on the cybercrime forum <strong>Cracked</strong> who used the monikers &#8220;<strong>ORN</strong>&#8221; and &#8220;<strong>ori0n</strong>.&#8221; The user &#8220;ori0n&#8221; mentioned in several posts that they could be reached on Telegram at the username &#8220;<strong>@sirorny</strong>.&#8221;</p>
<div id="attachment_69912" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69912" decoding="async" loading="lazy" class=" wp-image-69912" src="media/71b893a2.orn-araneida.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/orn-araneida.png" alt="" width="749" height="411" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/orn-araneida.png 1002w, https://krebsonsecurity.com/wp-content/uploads/2024/12/orn-araneida-768x422.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/orn-araneida-782x429.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-69912" class="wp-caption-text">Orn advertising Araneida Scanner in Feb. 2023 on the forum Cracked. Image: Ke-la.com.</p></div>
<p>The Sirorny Telegram identity also was referenced as a point of contact for a current user on the cybercrime forum Nulled who is selling website development services, and who references araneida[.]co as one of their projects. That user, &#8220;<strong>Exorn</strong>,&#8221; has posts dating back to August 2018.</p>
<p>In early 2020, Exorn promoted a website called &#8220;<strong>orndorks[.]com</strong>,&#8221; which they described as a service for automating the scanning for web-based vulnerabilities. A passive DNS lookup on this domain at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> shows that its email records pointed to the address <strong>ori0nbusiness@protonmail.com</strong>.</p>
<p><a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a>, a company that tracks information exposed in data breaches, finds this email address was used to register an account at <strong>Breachforums</strong> in July 2024 under the nickname &#8220;<strong>Ornie</strong>.&#8221; Constella also finds the same email registered at the website netguard[.]codes in 2021 using the password &#8220;<strong>ceza2003</strong>&#8221; [full disclosure: Constella is currently an advertiser on KrebsOnSecurity].</p>
<p>A search on the password ceza2003 in Constella finds roughly a dozen email addresses that used it in an exposed data breach, most of them featuring some variation on the name &#8220;<strong>altugsara</strong>,&#8221; including <strong>altugsara321@gmail.com</strong>. Constella further finds altugsara321@gmail.com was used to create an account at the cybercrime community <strong>RaidForums</strong> under the username &#8220;<strong>ori0n</strong>,&#8221; from an Internet address in Istanbul.</p>
<p>According to DomainTools, altugsara321@gmail.com was used in 2020 to register the domain name <strong>altugsara[.]com</strong>. <a href="https://web.archive.org/web/20211125114845/http://altugsara.com/" target="_blank" rel="noopener">Archive.org&#8217;s history for that domain</a> shows that in 2021 it featured a website for a then 18-year-old <strong>Altuğ Şara</strong> from Ankara, Turkey.</p>
<div id="attachment_69893" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69893" decoding="async" loading="lazy" class="size-full wp-image-69893" src="media/36c885ac.altugsaradotcom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/altugsaradotcom.png" alt="" width="749" height="345" /><p id="caption-attachment-69893" class="wp-caption-text">Archive.org&#8217;s recollection of what altugsara dot com looked like in 2021.</p></div>
<p><strong>LinkedIn</strong> finds this same <strong>altugsara[.]com</strong> domain listed in the &#8220;contact info&#8221; section of <a href="https://www.linkedin.com/in/altu%C4%9F-%C5%9Fara-58957b212/" target="_blank" rel="noopener">a profile</a> for an <strong>Altug Sara</strong> from Ankara, who says he has worked the past two years as a senior software developer for a Turkish IT firm called <strong>Bilitro Yazilim</strong>.</p>
<p>Neither Altug Sara nor Bilitro Yazilim responded to requests for comment.</p>
<p>Invicti&#8217;s website states that it has offices in Ankara, but the company&#8217;s CEO said none of their employees recognized either name.</p>
<p>&#8220;We do have a small team in Ankara, but as far as I know we have no connection to the individual other than the fact that they are also in Ankara,&#8221; Invicti CEO <strong>Neil Roseman</strong> told KrebsOnSecurity.</p>
<p>Researchers at Silent Push say despite Araneida using a seemingly endless supply of proxies to mask the true location of its users, it is a fairly &#8220;noisy&#8221; scanner that will kick off a large volume of requests to various API endpoints, and make requests to random URLs associated with different content management systems.</p>
<p>What&#8217;s more, the cracked version of Acunetix being resold to cybercriminals invokes legacy Acunetix SSL certificates on active control panels, which Silent Push says provides a solid pivot for finding some of this infrastructure, particularly from the Chinese threat actors.</p>
<p>Further reading: <a href="https://www.silentpush.com/blog/araneida-scanner-acunetix" target="_blank" rel="noopener">Silent Push&#8217;s research on Araneida Scanner</a>.</p>


feed_id: https://krebsonsecurity.com/?p=69936
title: Happy 15th Anniversary, KrebsOnSecurity!
uri: Happy-15th-Anniversary-KrebsOnSecurity
url: https://krebsonsecurity.com/2024/12/happy-15th-anniversary-krebsonsecurity/
content:
<div id="attachment_69961" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69961" decoding="async" class=" wp-image-69961" src="media/e2bd4b69.15bday.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/15bday.png" alt="" width="749" height="486" /><p id="caption-attachment-69961" class="wp-caption-text">Image: Shutterstock, Dreamansions.</p></div>
<p>KrebsOnSecurity.com turns 15 years old today! Maybe it&#8217;s indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024&#8217;s most engrossing security stories were about bad things happening to bad guys. It&#8217;s also an occasion to note that despite my publishing fewer stories than ever this past year, we somehow managed to attract near record levels of readership (thank you!).</p>
<p>In case you missed any of them, here&#8217;s a recap of 2024&#8217;s most-read stories. In January, KrebsOnSecurity told the story of a Canadian man who was falsely charged with larceny and lost his job after becoming the victim of a <a href="https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/" target="_blank" rel="noopener">complex e-commerce scam known as triangulation fraud.</a> This can occur when you buy something online — from a seller on <strong>Amazon</strong> or <strong>eBay</strong>, for example — but the seller doesn’t actually own the item for sale. Instead, they purchase the item using stolen payment card data and your shipping address. In this scam, you receive what you ordered, and the only party left to dispute the transaction is the owner of the stolen payment card.</p>
<div id="attachment_32692" style="width: 590px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-32692" decoding="async" loading="lazy" class="size-medium wp-image-32692" src="media/e0d5e871.triangulationfraud-580x318.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/11/triangulationfraud-580x318.png" alt="" width="580" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/11/triangulationfraud-580x318.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/11/triangulationfraud.png 637w" sizes="(max-width: 580px) 100vw, 580px" /><p id="caption-attachment-32692" class="wp-caption-text">Triangulation fraud. Image: eBay Enterprise.</p></div>
<p>March featured several investigations into the history of various people-search data broker services. One story exposed how the Belarusian CEO of the privacy and data removal service <strong>OneRep</strong> had actually <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">founded dozens of people-search services</a>, including many that OneRep was offering to remove people from for a fee. That story quickly <a href="https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-after-ceo-admits-to-running-people-search-networks/" target="_blank" rel="noopener">prompted Mozilla to terminate its partnership with OneRep</a>, which Mozilla had bundled as a privacy option for Firefox users.</p>
<p>A story digging into the consumer data broker <strong>Radaris</strong> <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">found its CEO was a fabricated identity</a>, and that the company&#8217;s founders were Russian brothers in Massachusetts who operated multiple Russian language dating services and affiliate programs, in addition to a dizzying array of people-search websites.</p>
<p>Radaris repeatedly threatened to sue KrebsOnSecurity unless that publication was retracted in full, alleging that it was replete with errors both factual and malicious. Instead, <a href="https://krebsonsecurity.com/2024/06/krebsonsecurity-threatened-with-defamation-lawsuit-over-fake-radaris-ceo/" target="_blank" rel="noopener">we doubled down and published all of the supporting evidence</a> that wasn&#8217;t included in the original story, leaving little room for doubt about its conclusions. Fittingly, Radaris now pimps OneRep as a service when consumers request that their personal information be removed from the data broker&#8217;s website.</p>
<p>Easily the longest story this year was <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">an investigation into Stark Industries Solutions</a>, a large, mysterious new Internet hosting firm that materialized when Russia invaded Ukraine. That piece revealed how Stark was being used as a global proxy network to conceal the true source of cyberattacks and disinformation campaigns against enemies of Russia.</p>
<div id="attachment_67471" style="width: 756px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67471" decoding="async" loading="lazy" class=" wp-image-67471" src="media/f5a3db0f.stark-industries-solutions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions.png" alt="" width="746" height="463" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions.png 1197w, https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions-768x477.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions-782x485.png 782w" sizes="(max-width: 746px) 100vw, 746px" /><p id="caption-attachment-67471" class="wp-caption-text">The homepage of Stark Industries Solutions.</p></div>
<p>Much of my summer was spent reporting a story about how advertising and marketing firms have created <a href="https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data/" target="_blank" rel="noopener">a global free-for-all where anyone can track the daily movements and associations of hundreds of millions of mobile devices</a>, thanks to the ubiquity of mobile location data that is broadly and cheaply available.<span id="more-69936"></span></p>
<p>Research published in September explored <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/" target="_blank" rel="noopener">the dark nexus between harm groups and cybercrime communities consumed with perpetrating financial fraud</a>. That analysis found an increasing number of young, Western cybercriminals are also members of fast-growing online groups that exist solely to bully, stalk, harass and extort vulnerable teens into physically harming themselves and others.</p>
<p>One focus of that story was a Canadian cybercriminal who used the nickname <strong>Judische. </strong>Identified by the Mandiant as one of the most consequential threat actors of 2024, Judische was responsible for a hacking rampage that exposed private information on hundreds of millions of Americans.  That story withheld Judische&#8217;s real name, but the reporting came in handy in late October when <a href="https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/" target="_blank" rel="noopener">a 25-year-old Canadian man named Connor Riley Moucka was arrested and charged with 20 criminal counts connected to the Snowflake data extortions</a>.</p>
<div id="attachment_69625" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69625" decoding="async" loading="lazy" class=" wp-image-69625" src="media/826bf791.moucka-surveillance.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance.png" alt="" width="747" height="573" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance.png 1137w, https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance-768x590.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/moucka-surveillance-782x600.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-69625" class="wp-caption-text">A surveillance photo of Connor Riley Moucka, a.k.a. &#8220;Judische&#8221; and &#8220;Waifu,&#8221; dated Oct 21, 2024, 9 days before Moucka&#8217;s arrest. This image was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP).</p></div>
<p>In November, KrebsOnSecurity published a profile of Judische&#8217;s accomplice &#8212; a hacker known as <strong>Kiberphant0m</strong> &#8212; detailing how Kiberphant0m had left a trail of clues strongly suggesting that <a href="https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/" target="_blank" rel="noopener">they are or recently were a U.S. Army soldier stationed in South Korea</a>.</p>
<p>My reporting in December was mainly split between two investigations. The first profiled <strong>Cryptomus</strong>, a dodgy cryptocurrency exchange allegedly based in Canada that has become a major payment processor and sanctions evasion platform <a href="https://krebsonsecurity.com/2024/12/how-cryptocurrency-turns-to-cash-in-russian-banks/" target="_blank" rel="noopener">for dozens of Russian exchanges and cybercrime services online</a>.</p>
<p><a href="https://krebsonsecurity.com/2024/12/how-to-lose-a-fortune-with-just-one-bad-click/" target="_blank" rel="noopener">How to Lose a Fortune with Just One Bad Click</a> told the sad tales of two cryptocurrency heist victims who were scammed out of six and seven figures after falling for complex social engineering schemes over the phone. In these attacks, the phishers abused at least four different Google services to trick targets into believing they were speaking with a Google representative, and into giving thieves control over their account with a single click. Look for a story here in early 2025 that will explore the internal operations of these ruthless and ephemeral voice phishing gangs.</p>
<p>Before signing off for 2024, allow me to remind readers that the reporting we&#8217;re able to provide here is made possible primarily by the ads you may see at the top of this website. If you currently don&#8217;t see any ads when you load this website, please consider enabling an exception in your ad blocker for KrebsOnSecurity.com. There is zero third-party content on this website, apart from the occasional Youtube video embedded as part of a story. More importantly, all of our ads are static images or GIFs that are vetted by me and served in-house directly.</p>
<p>Fundamentally, my work is supported and improved by <em>your</em> <em>readership</em>, tips, encouragement and, yes, criticism. So thank you for that, and keep it coming, please.</p>
<p>Here&#8217;s to a happy, healthy, wealthy and wary 2025. Hope to see you all again in the New Year!</p>


feed_id: https://krebsonsecurity.com/?p=69925
title: U.S. Army Soldier Arrested in AT&T, Verizon Extortions
uri: U-S-Army-Soldier-Arrested-in-AT-T-Verizon-Extortions
url: https://krebsonsecurity.com/2024/12/u-s-army-soldier-arrested-in-att-verizon-extortions/
content:
<p>Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being <strong>Kiberphant0m</strong>, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from <strong>AT&amp;T</strong> and <strong>Verizon</strong>. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea.</p>
<div id="attachment_69974" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69974" decoding="async" class=" wp-image-69974" src="media/72159dd7.camwagenius-selfie.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/camwagenius-selfie.png" alt="" width="750" height="743" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/camwagenius-selfie.png 779w, https://krebsonsecurity.com/wp-content/uploads/2024/12/camwagenius-selfie-768x761.png 768w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69974" class="wp-caption-text">One of several selfies on the Facebook page of Cameron Wagenius.</p></div>
<p><strong>Cameron John Wagenius</strong>, 20, was arrested near the Army base in Fort Hood, Texas on Dec. 20, after being indicted on two criminal counts of unlawful transfer of confidential phone records.</p>
<p>The sparse, <a href="media/6250f18b.wagenius-indictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/wagenius-indictment.pdf" target="_blank" rel="noopener">two-page indictment</a> (PDF) doesn&#8217;t reference specific victims or hacking activity, nor does it include any personal details about the accused. But a conversation with Wagenius&#8217; mother &#8212; Minnesota native <strong>Alicia Roen </strong>&#8212; filled in the gaps.</p>
<p>Roen said that prior to her son&#8217;s arrest he&#8217;d acknowledged being associated with <strong>Connor Riley Moucka</strong>, a.k.a. &#8220;<strong>Judische</strong>,&#8221; a prolific cybercriminal from Canada who was <a href="https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/" target="_blank" rel="noopener">arrested in late October</a> for stealing data from and extorting dozens of companies that stored data at the cloud service <strong>Snowflake</strong>.</p>
<p>In an interview with KrebsOnSecurity, Judische said he had no interest in selling the data he&#8217;d stolen from Snowflake customers and telecom providers, and that he preferred to outsource that to Kiberphant0m and others. Meanwhile, Kiberphant0m claimed in posts on Telegram that he was responsible for hacking into at least 15 telecommunications firms, including AT&amp;T and Verizon.</p>
<p>On November 26, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/" target="_blank" rel="noopener">published a story</a> that followed a trail of clues left behind by Kiberphantom indicating he was a U.S. Army soldier stationed in South Korea.</p>
<div id="attachment_69971" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69971" decoding="async" loading="lazy" class=" wp-image-69971" src="media/e13735d6.cwag-army.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/cwag-army.png" alt="" width="751" height="641" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/cwag-army.png 918w, https://krebsonsecurity.com/wp-content/uploads/2024/12/cwag-army-768x655.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/12/cwag-army-782x667.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-69971" class="wp-caption-text">An 18-year-old Cameron Wagenius, joining the U.S. Army.</p></div>
<p>Ms. Roen said Cameron worked on radio signals and network communications at an Army base in South Korea for the past two years, returning to the United States periodically. She said Cameron was always good with computers, but that she had no idea he might have been involved in criminal hacking.</p>
<p>&#8220;I never was aware he was into hacking,&#8221; Roen said. &#8220;It was definitely a shock to me when we found this stuff out.&#8221;</p>
<p>Ms. Roen said Cameron joined the Army as soon as he was of age, following in his older brother&#8217;s footsteps.</p>
<p>&#8220;He and his brother when they were like 6 and 7 years old would ask for MREs from other countries,&#8221; she recalled, referring to military-issued &#8220;meals ready to eat&#8221; food rations. &#8220;They both always wanted to be in the Army. I&#8217;m not sure where things went wrong.&#8221;<span id="more-69925"></span></p>
<p>Immediately after news broke of Moucka’s arrest, Kiberphant0m posted on the hacker community <strong>BreachForums</strong> what they claimed were the AT&amp;T call logs for <strong>President-elect</strong> <strong>Donald J. Trump</strong> and for <strong>Vice President Kamala Harris</strong>.</p>
<p>“In the event you do not reach out to us @ATNT all presidential government call logs will be leaked,” Kiberphant0m threatened, signing their post with multiple “#FREEWAIFU” tags. “You don’t think we don’t have plans in the event of an arrest? Think again.”</p>
<div id="attachment_69624" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69624" decoding="async" loading="lazy" class=" wp-image-69624" src="media/02ab1425.kiberphant0m-nsa-schema.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema.png" alt="" width="750" height="239" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema.png 1417w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema-768x245.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/kiberphant0m-nsa-schema-782x249.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69624" class="wp-caption-text">Kiberphant0m posting what he claimed was a &#8220;data schema&#8221; stolen from the NSA via AT&amp;T.</p></div>
<p>On that same day, Kiberphant0m posted what they claimed was the “data schema” from the <strong>U.S. National Security Agency</strong>.</p>
<p>On Nov. 5, Kiberphant0m offered call logs stolen from Verizon’s push-to-talk (PTT) customers — mainly U.S. government agencies and emergency first responders. On Nov. 9, Kiberphant0m posted a sales thread on BreachForums offering a “SIM-swapping” service targeting Verizon PTT customers. In a SIM-swap, fraudsters use credentials that are phished or stolen from mobile phone company employees to divert a target’s phone calls and text messages to a device they control.</p>
<p>The profile photo on Wagenius&#8217; Facebook page was deleted within hours of my Nov. 26 story identifying Kiberphant0m as a likely U.S. Army soldier. Still, many of his original profile photos remain, including several that show Wagenius in uniform while holding various Army-issued weapons.</p>
<div id="attachment_69972" style="width: 612px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69972" decoding="async" loading="lazy" class=" wp-image-69972" src="media/021e8796.wagenius-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/wagenius-fb.png" alt="" width="602" height="842" /><p id="caption-attachment-69972" class="wp-caption-text">Several profile photos visible on the Facebook page of Cameron Wagenius.</p></div>
<p>November&#8217;s story on Kiberphant0m cited his own Telegram messages saying he maintained a large botnet that was used for distributed denial-of-service (DDoS) attacks to knock websites, users and networks offline. In 2023, Kiberphant0m sold remote access credentials for a major U.S. defense contractor.</p>
<p><strong>Allison Nixon</strong> is chief research officer at the New York-based cybersecurity firm <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a> who helped track down Kiberphant0m&#8217;s real life identity. Nixon was among several security researchers who faced harassment and specific threats of violence from Judische and his associates.</p>
<p>&#8220;Anonymously extorting the President and VP as a member of the military is a bad idea, but it&#8217;s an even worse idea to harass people who specialize in de-anonymizing cybercriminals,&#8221; Nixon told KrebsOnSecurity. She said the investigation into Kiberphant0m shows that law enforcement is getting better and faster at going after cybercriminals &#8212; especially those who are actually living in the United States.</p>
<p>&#8220;Between when we, and an anonymous colleague, found his opsec mistake on November 10th to his last Telegram activity on December 6, law enforcement set the speed record for the fastest turnaround time for an American federal cyber case that I have witnessed in my career,&#8221; she said.</p>
<p>Nixon asked to share a message for all the other Kiberphant0ms out there who think they can&#8217;t be found and arrested.</p>
<p>&#8220;I know that young people involved in cybercrime will read these articles,&#8221; Nixon said. &#8220;You need to stop doing stupid shit and get a lawyer. Law enforcement wants to put all of you in prison for a long time.&#8221;</p>
<p>The indictment against Wagenius was filed in Texas, but the case has been transferred to the U.S. District Court for the Western District of Washington in Seattle.</p>


feed_id: https://krebsonsecurity.com/?p=69922
title: A Day in the Life of a Prolific Voice Phishing Crew
uri: A-Day-in-the-Life-of-a-Prolific-Voice-Phishing-Crew
url: https://krebsonsecurity.com/2025/01/a-day-in-the-life-of-a-prolific-voice-phishing-crew/
content:
<p>Besieged by scammers seeking to phish user accounts over the telephone, <strong>Apple</strong> and <strong>Google</strong> frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound communications to their users, including emails, automated phone calls and system-level messages sent to all signed-in devices.</p>
<div id="attachment_69859" style="width: 711px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69859" decoding="async" class="size-full wp-image-69859" src="media/3dc2a3bb.thumb-mobile.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/thumb-mobile.png" alt="" width="701" height="413" /><p id="caption-attachment-69859" class="wp-caption-text">Image: Shutterstock, iHaMoo.</p></div>
<p>KrebsOnSecurity recently told the saga of a cryptocurrency investor named <strong>Tony</strong> who was robbed of more than $4.7 million in <a href="https://krebsonsecurity.com/2024/12/how-to-lose-a-fortune-with-just-one-bad-click/" target="_blank" rel="noopener">an elaborate voice phishing attack</a>. In Tony&#8217;s ordeal, the crooks appear to have initially contacted him via <strong>Google Assistant</strong>, an AI-based service that can engage in two-way conversations. The phishers also abused legitimate Google services to send Tony an email from google.com, and to send a Google account recovery prompt to all of his signed-in devices.</p>
<p>Today&#8217;s story pivots off of Tony&#8217;s heist and new details shared by a scammer to explain how these voice phishing groups are abusing a legitimate Apple telephone support line to generate &#8220;account confirmation&#8221; message prompts from Apple to their customers.</p>
<p>Before we get to the Apple scam in detail, we need to revisit Tony&#8217;s case. The phishing domain used to steal roughly $4.7 million in cryptocurrencies from Tony was <strong>verify-trezor[.]io</strong>. This domain was featured in <a href="https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit" target="_blank" rel="noopener">a writeup from February 2024</a> by the security firm <strong>Lookout</strong>, which found it was one of dozens being used by a prolific and audacious voice phishing group it dubbed &#8220;<strong>Crypto Chameleon</strong>.&#8221;</p>
<p>Crypto Chameleon was brazenly trying to voice phish employees at the <strong>U.S. Federal Communications Commission</strong> (FCC), as well as those working at the cryptocurrency exchanges <strong>Coinbase</strong> and <strong>Binance</strong>. Lookout researchers discovered multiple voice phishing groups were using a new phishing kit that closely mimicked the single sign-on pages for <strong>Okta</strong> and other authentication providers.</p>
<p>As we&#8217;ll see in a moment, that phishing kit is operated and rented out by a cybercriminal known as &#8220;<strong>Perm</strong>&#8221; a.k.a. &#8220;<strong>Annie</strong>.&#8221; Perm is the current administrator of <strong>Star Fraud</strong>, one of the more consequential cybercrime communities on Telegram and one that has emerged as a foundry of innovation in voice phishing attacks.</p>
<p>A review of the many messages that Perm posted to Star Fraud and other Telegram channels showed they worked closely with another cybercriminal who went by the handles &#8220;<strong>Aristotle</strong>&#8221; and just &#8220;<strong>Stotle</strong>.&#8221;</p>
<p>It is not clear what caused the rift, but at some point last year Stotle decided to turn on his erstwhile business partner Perm, sharing extremely detailed videos, tutorials and secrets that shed new light on how these phishing panels operate.</p>
<p>Stotle explained that the division of spoils from each robbery is decided in advance by all participants. Some co-conspirators will be paid a set fee for each call, while others are promised a percentage of any overall amount stolen. The person in charge of managing or renting out the phishing panel to others will generally take a percentage of each theft, which in Perm&#8217;s case is 10 percent.</p>
<p>When the phishing group settles on a target of interest, the scammers will create and join a new <strong>Discord</strong> channel. This allows each logged on member to share what is currently on their screen, and these screens are tiled in a series of boxes so that everyone can see all other call participant screens at once.</p>
<p>Each participant in the call has a specific role, including:</p>
<p>-The Caller: The person speaking and trying to social engineer the target.<br />
-The Operator: The individual managing the phishing panel, silently moving the victim from page to page.<br />
-The Drainer: The person who logs into compromised accounts to drain the victim&#8217;s funds.<br />
-The Owner: The phishing panel owner, who will frequently listen in on and participate in scam calls.</p>
<h2>&#8216;OKAY, SO THIS REALLY IS APPLE&#8217;</h2>
<p>In one video of a live voice phishing attack shared by Stotle, scammers using Perm&#8217;s panel targeted a musician in California. Throughout the video, we can see Perm monitoring the conversation and operating the phishing panel in the upper right corner of the screen.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/F44un1_y2fs?si=fmYxbcLS3TDtHjrs" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"><span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start">﻿</span></iframe></div>
<p>In the first step of the attack, they <a href="https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/" target="_blank" rel="noopener">peppered the target&#8217;s Apple device with notifications from Apple</a> by attempting to reset his password. Then a &#8220;<strong>Michael Keen</strong>&#8221; called him, spoofing Apple&#8217;s phone number and saying they were with Apple&#8217;s account recovery team.</p>
<p>The target told Michael that someone was trying to change his password, which Michael calmly explained they would investigate. Michael said he was going to send a prompt to the man&#8217;s device, and proceeded to place a call to an automated line that answered as Apple support saying, &#8220;I&#8217;d like to send a consent notification to your Apple devices. Do I have permission to do that?&#8221;</p>
<p>In this segment of the video, we can see the operator of the panel is calling the real Apple customer support phone number <strong>800-275-2273</strong>, but they are doing so by spoofing the target&#8217;s phone number (the victim&#8217;s number is redacted in the video above). That&#8217;s because calling this support number from a phone number tied to an Apple account and selecting &#8220;1&#8221; for &#8220;yes&#8221; will then send an alert from Apple that displays the following message on all associated devices:</p>
<div id="attachment_70000" style="width: 403px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70000" decoding="async" loading="lazy" class="size-full wp-image-70000" src="media/4d5fdcb6.appleconfirmation.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/appleconfirmation.png" alt="" width="393" height="448" /><p id="caption-attachment-70000" class="wp-caption-text">Calling the Apple support number 800-275-2273 from a phone number tied to an Apple account will cause a prompt similar to this one to appear on all connected Apple devices.</p></div>
<p>KrebsOnSecurity asked two different security firms to test this using the caller ID spoofing service shown in Perm&#8217;s video, and sure enough calling that 800 number for Apple by spoofing my phone number as the source caused the Apple Account Confirmation to pop up on all of my signed-in Apple devices.</p>
<p>In essence, the voice phishers are using an automated Apple phone support line to send notifications from Apple and to trick people into thinking they&#8217;re really talking with Apple. The phishing panel video leaked by Stotle shows this technique fooled the target, who felt completely at ease that he was talking to Apple after receiving the support prompt on his iPhone.</p>
<p>&#8220;Okay, so this really is Apple,&#8221; the man said after receiving the alert from Apple. &#8220;Yeah, that&#8217;s definitely not me trying to reset my password.&#8221;</p>
<p>&#8220;Not a problem, we can go ahead and take care of this today,&#8221; Michael replied. &#8220;I&#8217;ll go ahead and prompt your device with the steps to close out this ticket. Before I do that, I do highly suggest that you change your password in the settings app of your device.&#8221;</p>
<p>The target said they weren&#8217;t sure exactly how to do that. Michael replied &#8220;no problem,&#8221; and then described how to change the account password, which the man said he did on his own device. At this point, the musician was still in control of his iCloud account.</p>
<p>&#8220;Password is changed,&#8221; the man said. &#8220;I don&#8217;t know what that was, but I appreciate the call.&#8221;</p>
<p>&#8220;Yup,&#8221; Michael replied, setting up the killer blow. &#8220;I&#8217;ll go ahead and prompt you with the next step to close out this ticket. Please give me one moment.&#8221;</p>
<p>The target then received a text message that referenced information about his account, stating that he was in a support call with Michael. Included in the message was a link to a website that mimicked Apple&#8217;s iCloud login page &#8212; <strong>17505-apple[.]com</strong>. Once the target navigated to the phishing page, the video showed Perm&#8217;s screen in the upper right corner opening the phishing page from their end.</p>
<p>&#8220;Oh okay, now I log in with my Apple ID?,&#8221; the man asked.</p>
<p>&#8220;Yup, then just follow the steps it requires, and if you need any help, just let me know,&#8221; Michael replied.</p>
<p>As the victim typed in their Apple password and one-time passcode at the fake Apple site, Perm&#8217;s screen could be seen in the background logging into the victim&#8217;s iCloud account.</p>
<p>It&#8217;s unclear whether the phishers were able to steal any cryptocurrency from the victim in this case, who did not respond to requests for comment. However, shortly after this video was recorded, someone leaked several music recordings stolen from the victim&#8217;s iCloud account.</p>
<p>At the conclusion of the call, Michael offered to configure the victim&#8217;s Apple profile so that any further changes to the account would need to happen in person at a physical Apple store. This appears to be one of several scripted ploys used by these voice phishers to gain and maintain the target&#8217;s confidence.</p>
<p>A tutorial shared by Stotle titled &#8220;Social Engineering Script&#8221; includes a number of tips for scam callers that can help establish trust or a rapport with their prey. When the callers are impersonating Coinbase employees, for example, they will offer to sign the user up for the company&#8217;s free security email newsletter.</p>
<p>&#8220;Also, for your security, we are able to subscribe you to Coinbase Bytes, which will basically give you updates to your email about data breaches and updates to your Coinbase account,&#8221; the script reads. &#8220;So we should have gone ahead and successfully subscribed you, and you should have gotten an email confirmation. Please let me know if that is the case. Alright, perfect.&#8221;</p>
<p>In reality, all they are doing is entering the target&#8217;s email address into Coinbase&#8217;s public email newsletter signup page, but it&#8217;s a remarkably effective technique because it demonstrates to the would-be victim that the caller has the ability to send emails from Coinbase.com.</p>
<p>Asked to comment for this story, Apple said there has been no breach, hack, or technical exploit of iCloud or Apple services, and that the company is continuously adding new protections to address new and emerging threats. For example, it said it has implemented rate limiting for multi-factor authentication requests, which <a href="https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/" target="_blank" rel="noopener">have been abused by voice phishing groups to impersonate Apple</a>.</p>
<p>Apple said its representatives will never ask users to provide their password, device passcode, or two-factor authentication code or to enter it into a web page, even if it looks like an official Apple website. If a user receives a message or call that claims to be from Apple, <a href="https://support.apple.com/en-us/120569" target="_blank" rel="noopener">here is what the user should expect</a>.</p>
<p><span id="more-69922"></span></p>
<h2>AUTODOXERS</h2>
<p>According to Stotle, the target lists used by their phishing callers originate mostly from a few crypto-related data breaches, including the 2022 and <a href="https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8?gi=4a9e1da3b8b2" target="_blank" rel="noopener">2024 breaches</a> involving user account data stolen from cryptocurrency hardware wallet vendor <strong>Trezor</strong>.</p>
<p>Perm&#8217;s group and other crypto phishing gangs rely on a mix of homemade code and third-party data broker services to refine their target lists. Known as &#8220;<strong>autodoxers</strong>,&#8221; these tools help phishing gangs quickly automate the acquisition and/or verification of personal data on a target prior to each call attempt.</p>
<div id="attachment_69998" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69998" decoding="async" loading="lazy" class=" wp-image-69998" src="media/41709ca7.vbals-autodoxer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/vbals-autodoxer.png" alt="" width="748" height="592" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/vbals-autodoxer.png 1067w, https://krebsonsecurity.com/wp-content/uploads/2025/01/vbals-autodoxer-768x607.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/vbals-autodoxer-782x619.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-69998" class="wp-caption-text">One &#8220;autodoxer&#8221; service advertised on Telegram that promotes a range of voice phishing tools and services.</p></div>
<p>Stotle said their autodoxer used a Telegram bot that leverages hacked accounts at consumer data brokers to gather a wealth of information about their targets, including their full Social Security number, date of birth, current and previous addresses, employer, and the names of family members.</p>
<p>The autodoxers are used to verify that each email address on a target list has an active account at Coinbase or another cryptocurrency exchange, ensuring that the attackers don&#8217;t waste time calling people who have no cryptocurrency to steal.</p>
<p>Some of these autodoxer tools also will check the value of the target&#8217;s home address at property search services online, and then sort the target lists so that the wealthiest are at the top.</p>
<h2>CRYPTO THIEVES IN THE SHARK TANK</h2>
<p>Stotle&#8217;s messages on Discord and Telegram show that a phishing group renting Perm&#8217;s panel voice-phished tens of thousands of dollars worth of cryptocurrency from the billionaire <strong>Mark Cuban</strong>.</p>
<p>&#8220;I was an idiot,&#8221; Cuban told KrebsOnsecurity when asked about <a href="https://www.dallasnews.com/business/2024/06/23/mark-cubans-public-email-was-hacked-after-receiving-call-from-a-fake-google-rep/?outputType=amp" target="_blank" rel="noopener">the June 2024 attack</a>, which he first disclosed in a short-lived post on Twitter/X. &#8220;We were shooting Shark Tank and I was rushing between pitches.&#8221;</p>
<div id="attachment_70008" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70008" decoding="async" loading="lazy" class=" wp-image-70008" src="media/ac34b035.sharktank.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/sharktank.png" alt="" width="749" height="435" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/sharktank.png 780w, https://krebsonsecurity.com/wp-content/uploads/2025/01/sharktank-768x446.png 768w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70008" class="wp-caption-text">Image: Shutterstock, ssi77.</p></div>
<p>Cuban said he first received a notice from Google that someone had tried to log in to his account. Then he got a call from what appeared to be a Google phone number. Cuban said he ignored several of these emails and calls until he decided they probably wouldn&#8217;t stop unless he answered.</p>
<p>&#8220;So I answered, and wasn&#8217;t paying enough attention,&#8221; he said. &#8220;They asked for the circled number that comes up on the screen. Like a moron, I gave it to them, and they were in.&#8221;</p>
<p>Unfortunately for Cuban, somewhere in his inbox were the secret &#8220;seed phrases&#8221; protecting two of his cryptocurrency accounts, and armed with those credentials the crooks were able to drain his funds. All told, the thieves managed to steal roughly $43,000 worth of cryptocurrencies from Cuban&#8217;s wallets &#8212; a relatively small heist for this crew.</p>
<p>&#8220;They must have done some keyword searches,&#8221; once inside his Gmail account, Cuban said. &#8220;I had sent myself an email I had forgotten about that had my seed words for 2 accounts that weren&#8217;t very active any longer. I had moved almost everything but some smaller balances to Coinbase.&#8221;</p>
<h2>LIFE IS A GAME: MONEY IS HOW WE KEEP SCORE</h2>
<p>Cybercriminals involved in voice phishing communities on Telegram are universally obsessed with their crypto holdings, mainly because in this community one&#8217;s demonstrable wealth is primarily what confers social status. It is not uncommon to see members sizing one another up using a verbal shorthand of &#8220;figs,&#8221; as in figures of crypto wealth.</p>
<p>For example, a low-level caller with no experience will sometimes be mockingly referred to as a 3fig or 3f, as in a person with less than $1,000 to their name. Salaries for callers are often also referenced this way, e.g. &#8220;Weekly salary: 5f.&#8221;</p>
<div id="attachment_70058" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70058" decoding="async" loading="lazy" class=" wp-image-70058" src="media/69b7ab99.howitstartedhowitsgoing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/howitstartedhowitsgoing.png" alt="" width="749" height="416" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/howitstartedhowitsgoing.png 1265w, https://krebsonsecurity.com/wp-content/uploads/2025/01/howitstartedhowitsgoing-768x426.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/howitstartedhowitsgoing-782x434.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70058" class="wp-caption-text">This meme shared by Stotle uses humor to depict an all-too-common pathway for voice phishing callers, who are often minors recruited from gaming networks like Minecraft and Roblox. The image that Lookout used in its blog post for Crypto Chameleon can be seen in the lower right hooded figure.</p></div>
<p>Voice phishing groups frequently require new members to provide &#8220;proof of funds&#8221; &#8212; screenshots of their crypto holdings, ostensibly to demonstrate they are not penniless &#8212; before they&#8217;re allowed to join.</p>
<p>This proof of funds (POF) demand is typical among thieves selling high-dollar items, because it tends to cut down on the time-wasting inquiries from criminals who can&#8217;t afford what&#8217;s for sale anyway. But it has become so common in cybercrime communities that there are now several services designed to create fake POF images and videos, allowing customers to brag about large crypto holdings without actually possessing said wealth.</p>
<p>Several of the phishing panel videos shared by Stotle feature audio that suggests co-conspirators were practicing responses to certain call scenarios, while other members of the phishing group critiqued them or tried disrupt their social engineering by being verbally abusive.</p>
<p>These groups will organize and operate for a few weeks, but tend to disintegrate when one member of the conspiracy decides to steal some or all of the loot, referred to in these communities as &#8220;snaking&#8221; others out of their agreed-upon sums. Almost invariably, the phishing groups will splinter apart over the drama caused by one of these snaking events, and individual members eventually will then re-form a new phishing group.</p>
<p><strong>Allison Nixon</strong> is the chief research officer for <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a>, a cybersecurity firm in New York that has worked on a number of investigations involving these voice phishing groups. Nixon said the constant snaking within the voice phishing circles points to a psychological self-selection phenomenon that is in desperate need of academic study.</p>
<p>&#8220;In short, a person whose moral compass lets them rob old people will also be a bad business partner,&#8221; Nixon said. &#8220;This is another fundamental flaw in this ecosystem and why most groups end in betrayal. This structural problem is great for journalists and the police too. Lots of snitching.&#8221;</p>
<h2>POINTS FOR BRAZENNESS</h2>
<p>Asked about the size of Perm&#8217;s phishing enterprise, Stotle said there were dozens of distinct phishing groups paying to use Perm&#8217;s panel. He said each group was assigned their own subdomain on Perm&#8217;s main &#8220;command and control server,&#8221; which naturally uses the domain name <strong>commandandcontrolserver[.]com</strong>.</p>
<p>A review of that domain&#8217;s history via <strong>DomainTools.com</strong> shows there are at least 57 separate subdomains scattered across commandandcontrolserver[.]com and two other related control domains &#8212; <strong>thebackendserver[.]com</strong> and <strong>lookoutsucks[.]com</strong>. That latter domain was created and deployed shortly after Lookout published its blog post on Crypto Chameleon.</p>
<p>The <a href="https://urlscan.io/search/#page.url%3A%22captcha%3Forigin%3D%22" target="_blank" rel="noopener">dozens of phishing domains that phone home to these control servers</a> are all kept offline when they are not actively being used in phishing attacks. A social engineering training guide shared by Stotle explains this practice minimizes the chances that a phishing domain will get &#8220;redpaged,&#8221; a reference to the default red warning pages served by Google Chrome or Firefox whenever someone tries to visit a site that&#8217;s been flagged for phishing or distributing malware.</p>
<p>What&#8217;s more, while the phishing sites are live their operators typically place a CAPTCHA challenge in front of the main page to prevent security services from scanning and flagging the sites as malicious.</p>
<p>It may seem odd that so many cybercriminal groups operate so openly on instant collaboration networks like Telegram and Discord. After all, this blog is replete with stories about cybercriminals getting caught thanks to personal details they inadvertently leaked or disclosed themselves.</p>
<p>Nixon said the relative openness of these cybercrime communities makes them inherently risky, but it also allows for the rapid formation and recruitment of new potential co-conspirators. Moreover, today&#8217;s English-speaking cybercriminals tend to be <a href="https://krebsonsecurity.com/2024/10/lamborghini-carjackers-lured-by-243m-cyberheist/" target="_blank" rel="noopener">more afraid of getting home invaded or mugged by fellow cyber thieves</a> than they are of being arrested by authorities.</p>
<p>&#8220;The biggest structural threat to the online criminal ecosystem is not the police or researchers, it is fellow criminals,&#8221; Nixon said. &#8220;To protect them from themselves, every criminal forum and marketplace has a reputation system, even though they know it&#8217;s a major liability when the police come. That is why I am not worried as we see criminals migrate to various &#8216;encrypted&#8217; platforms that promise to ignore the police. To protect themselves better against the law, they have to ditch their protections against fellow criminals and that&#8217;s not going to happen.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=70070
title: Microsoft: Happy 2025. Here’s 161 Security Updates
uri: Microsoft-Happy-2025-Here-s-161-Security-Updates
url: https://krebsonsecurity.com/2025/01/microsoft-happy-2025-heres-161-security-updates/
content:
<p><strong>Microsoft</strong> today unleashed updates to plug a whopping 161 security vulnerabilities in <strong>Windows</strong> and related software, including three &#8220;zero-day&#8221; weaknesses that are already under active attack. Redmond&#8217;s inaugural Patch Tuesday of 2025 bundles more fixes than the company has shipped in one go since 2017.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p><strong>Rapid7</strong>&#8216;s <strong>Adam Barnett</strong> says January marks the fourth consecutive month where Microsoft has published zero-day vulnerabilities on Patch Tuesday without evaluating any of them as critical severity at time of publication. Today also saw the publication of nine critical remote code execution (RCE) vulnerabilities.</p>
<p>The Microsoft flaws already seeing active attacks include <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21333" target="_blank" rel="noopener">CVE-2025-21333</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21334" target="_blank" rel="noopener">CVE-2025-21334</a> and, you guessed it&#8211; <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21335" target="_blank" rel="noopener">CVE-2025-21335</a>. These are sequential because all reside in <strong>Windows Hyper-V</strong>, a component that is heavily embedded in modern <strong>Windows 11</strong> operating systems and used for security features including device guard and credential guard.</p>
<p>Tenable&#8217;s <strong>Satnam Narang</strong> says little is known about the in-the-wild exploitation of these flaws, apart from the fact that they are all &#8220;privilege escalation&#8221; vulnerabilities. Narang said we tend to see a lot of elevation of privilege bugs exploited in the wild as zero-days in Patch Tuesday because it&#8217;s not always initial access to a system that&#8217;s a challenge for attackers as they have various avenues in their pursuit.</p>
<p>&#8220;As elevation of privilege bugs, they’re being used as part of post-compromise activity, where an attacker has already accessed a target system,&#8221; he said. &#8220;It&#8217;s kind of like if an attacker is able to enter a secure building, they’re unable to access more secure parts of the facility because they have to prove that they have clearance. In this case, they’re able to trick the system into believing they should have clearance.&#8221;<span id="more-70070"></span></p>
<p>Several bugs addressed today earned CVSS (threat rating) scores of 9.8 out of a possible 10, including <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21298" target="_blank" rel="noopener">CVE-2025-21298</a>, a weakness in Windows that could allow attackers to run arbitrary code by getting a target to open a malicious <strong>.rtf</strong> file, documents typically opened on Office applications like Microsoft Word. Microsoft has rated this flaw &#8220;exploitation more likely.&#8221;</p>
<p><strong>Bob Hopkins</strong> at <strong>Immersive Labs</strong> called attention to the <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21311" target="_blank" rel="noopener">CVE-2025-21311</a>, a 9.8 &#8220;critical&#8221; bug in <strong>Windows NTLMv1</strong> (NT LAN Manager version 1), an older Microsoft authentication protocol that is still used by many organizations.</p>
<p>&#8220;What makes this vulnerability so impactful is the fact that it is remotely exploitable, so attackers can reach the compromised machine(s) over the internet, and the attacker does not need significant knowledge or skills to achieve repeatable success with the same payload across any vulnerable component,&#8221; Hopkins wrote.</p>
<p><strong>Kev Breen</strong> at Immersive points to an interesting flaw (<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21210" target="_blank" rel="noopener">CVE-2025-21210</a>) that Microsoft fixed in its full disk encryption suite <strong>Bitlocker</strong> that the software giant has dubbed &#8220;exploitation more likely.&#8221; Specifically, this bug holds out the possibility that in some situations the hibernation image created when one closes the laptop lid on an open Windows session may not be fully encrypted and could be recovered in plain text.</p>
<p>&#8220;Hibernation images are used when a laptop goes to sleep and contains the contents that were stored in RAM at the moment the device powered down,&#8221; Breen noted. &#8220;This presents a significant potential impact as RAM can contain sensitive data (such as passwords, credentials and PII) that may have been in open documents or browser sessions and can all be recovered with free tools from hibernation files.&#8221;</p>
<p>Tenable&#8217;s Narang also highlighted a trio of vulnerabilities in <strong>Microsoft Access</strong> fixed this month and credited to Unpatched.ai, a security research effort that is aided by artificial intelligence looking for vulnerabilities in code. Tracked as <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21186" target="_blank" rel="noopener">CVE-2025-21186</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21366" target="_blank" rel="noopener">CVE-2025-21366</a>, and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21395" target="_blank" rel="noopener">CVE-2025-21395</a>, these are remote code execution bugs that are exploitable if an attacker convinces a target to download and run a malicious file through social engineering. Unpatched.ai was also credited with discovering a flaw in the December 2024 Patch Tuesday release (<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49142" target="_blank" rel="noopener">CVE-2024-49142</a>).</p>
<p>&#8220;Automated vulnerability detection using AI has garnered a lot of attention recently, so it’s noteworthy to see this service being credited with finding bugs in Microsoft products,&#8221; Narang observed. &#8220;It may be the first of many in 2025.&#8221;</p>
<p>If you&#8217;re a Windows user who has automatic updates turned off and haven&#8217;t updated in a while, it&#8217;s probably time to play catch up. Please consider backing up important files and/or the entire hard drive before updating. And if you run into any problems installing this month&#8217;s patch batch, drop a line in the comments below, please.</p>
<p>Further reading on today&#8217;s patches from Microsoft:</p>
<p><a href="https://www.tenable.com/blog/microsofts-january-2025-patch-tuesday-157-cves-cve-2025-21333-cve-2025-21334-cve-2025-21335" target="_blank" rel="noopener">Tenable blog</a></p>
<p><a href="https://isc.sans.edu/forums/diary/Microsoft%20January%202025%20Patch%20Tuesday/31590/" target="_blank" rel="noopener">SANS Internet Storm Center</a></p>
<p><a href="https://www.askwoody.com" target="_blank" rel="noopener">Ask Woody</a></p>


feed_id: https://krebsonsecurity.com/?p=70091
title: Chinese Innovations Spawn Wave of Toll Phishing Via SMS
uri: Chinese-Innovations-Spawn-Wave-of-Toll-Phishing-Via-SMS
url: https://krebsonsecurity.com/2025/01/chinese-innovations-spawn-wave-of-toll-phishing-via-sms/
content:
<p>Residents across the United States are being inundated with text messages purporting to come from toll road operators like <strong>E-ZPass</strong>, warning that recipients face fines if a delinquent toll fee remains unpaid. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to set up convincing lures spoofing toll road operators in multiple U.S. states.</p>
<p>Last week, the <strong>Massachusetts Department of Transportation</strong> (MassDOT) <a href="https://www.ezdrivema.com/About-EzdriveMA/Smishing-Alert" target="_blank" rel="noopener">warned residents</a> to be on the lookout for a new SMS phishing or &#8220;smishing&#8221; scam targeting users of <strong>EZDriveMA</strong>, MassDOT&#8217;s all electronic tolling program. Those who fall for the scam are asked to provide payment card data, and eventually will be asked to supply a one-time password sent via SMS or a mobile authentication app.</p>
<p>Reports of similar SMS phishing attacks against customers of other U.S. state-run toll facilities surfaced around the same time as the MassDOT alert. People in Florida reported receiving SMS phishing that spoofed <strong>Sunpass</strong>, Florida&#8217;s prepaid toll program.</p>
<div id="attachment_70096" style="width: 503px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70096" decoding="async" class="size-full wp-image-70096" src="media/071b7f42.lighthouse-ezdrive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/lighthouse-ezdrive.png" alt="" width="493" height="683" /><p id="caption-attachment-70096" class="wp-caption-text">This phishing module for spoofing MassDOT&#8217;s EZDrive toll system was offered on Jan. 10, 2025 by a China-based SMS phishing service called &#8220;Lighthouse.&#8221;</p></div>
<p>In Texas, residents said they received text messages about unpaid tolls with the <strong>North Texas Toll Authority</strong>. Similar reports came from readers in California, Colorado, Connecticut, Minnesota, and Washington. This is by no means a comprehensive list.</p>
<div id="attachment_70097" style="width: 503px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70097" decoding="async" loading="lazy" class="size-full wp-image-70097" src="media/f88392e6.lighthouse-ntta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/lighthouse-ntta.png" alt="" width="493" height="683" /><p id="caption-attachment-70097" class="wp-caption-text">A new module from the Lighthouse SMS phishing kit released Jan. 14 targets customers of the North Texas Toll Authority (NTTA).</p></div>
<p>In each case, the emergence of these SMS phishing attacks coincided with the release of new phishing kit capabilities that closely mimic these toll operator websites as they appear on mobile devices. Notably, none of the phishing pages will even load unless the website detects that the visitor is coming from a mobile device.</p>
<p><strong>Ford Merrill</strong> works in security research at <a href="https://www.secalliance.com" target="_blank" rel="noopener">SecAlliance</a>, a <a href="https://www.csis.com" target="_blank" rel="noopener">CSIS Security Group</a> company. Merrill said the volume of SMS phishing attacks spoofing toll road operators skyrocketed after the New Year, when at least one Chinese cybercriminal group known for selling sophisticated SMS phishing kits began offering new phishing pages designed to spoof toll operators in various U.S. states.</p>
<p>According to Merrill, multiple China-based cybercriminals are selling distinct SMS-based phishing kits that each have hundreds or thousands of customers. The ultimate goal of these kits, he said, is to phish enough information from victims that their payment cards can be added to mobile wallets and used to buy goods at physical stores, online, or to launder money through shell companies.<span id="more-70091"></span></p>
<div id="attachment_70098" style="width: 503px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70098" decoding="async" loading="lazy" class="size-full wp-image-70098" src="media/031d7d3e.lighthouse-tollroads.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/lighthouse-tollroads.png" alt="" width="493" height="683" /><p id="caption-attachment-70098" class="wp-caption-text">A component of the Chinese SMS phishing kit Lighthouse made to target customers of The Toll Roads, which refers to several state routes through Orange County, Calif.</p></div>
<p>Merrill said the different purveyors of these SMS phishing tools traditionally have impersonated shipping companies, customs authorities, and even governments with tax refund lures and visa or immigration renewal scams targeting people who may be living abroad or new to a country.</p>
<p>&#8220;What we&#8217;re seeing with these tolls scams is just a continuation of the Chinese smishing groups rotating from package redelivery schemes to toll road scams,&#8221; Merrill said. &#8220;Every one of us by now is sick and tired of receiving these package smishing attacks, so now it&#8217;s a new twist on an existing scam.”</p>
<p>In October 2023, KrebsOnSecurity wrote about <a href="https://krebsonsecurity.com/2023/10/phishers-spoof-usps-12-other-natl-postal-services/" target="_blank" rel="noopener">a massive uptick in SMS phishing scams targeting <strong>U.S. Postal Service</strong> customers</a>. That story revealed the surge was tied to innovations introduced by &#8220;<strong>Chenlun</strong>,&#8221; a mainland China-based proprietor of a popular phishing kit and service. At the time, Chenlun had just introduced new phishing pages made to impersonate postal services in the United States and at least a dozen other countries.</p>
<p>SMS phishing kits are hardly new, but Merrill said Chinese smishing groups recently have introduced innovations in deliverability, by more seamlessly integrating their spam messages with Apple&#8217;s <strong>iMessage</strong> technology, and with <a href="https://support.google.com/messages/answer/7189714?hl=en" target="_blank" rel="noopener">RCS</a>, the equivalent &#8220;rich text&#8221; messaging capability built into <strong>Android</strong> devices.</p>
<p>“While traditional smishing kits relied heavily on SMS for delivery, nowadays the actors make heavy use of iMessage and RCS because telecom operators can’t filter them and they likely have a higher success rate with these delivery channels,” he said.</p>
<p>It remains unclear how the phishers have selected their targets, or from where their data may be sourced. A notice from MassDOT cautions that &#8220;the targeted phone numbers seem to be chosen at random and are not uniquely associated with an account or usage of toll roads.&#8221;</p>
<p>Indeed, one reader shared on Mastodon yesterday that they&#8217;d received one of these SMS phishing attacks spoofing a local toll operator, when they didn&#8217;t even own a vehicle.</p>
<p>Targeted or not, these phishing websites are dangerous because they are operated dynamically in real-time by criminals. If you receive one of these messages, just ignore it or delete it, but please do not visit the phishing site. The FBI asks that before you bin the missives, consider filing a complaint with the agency&#8217;s <a href="https://www.ic3.gov" target="_blank" rel="noopener">Internet Crime Complaint Center</a> (IC3), including the phone number where the text originated, and the website listed within the text.</p>


feed_id: https://krebsonsecurity.com/?p=70117
title: MasterCard DNS Error Went Unnoticed for Years
uri: MasterCard-DNS-Error-Went-Unnoticed-for-Years
url: https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/
content:
<p>The payment card giant <strong>MasterCard</strong> just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to register the domain and prevent it from being grabbed by cybercriminals.</p>
<div id="attachment_70128" style="width: 677px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70128" decoding="async" class="size-full wp-image-70128" src="media/7e2da9e4.akamne.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/akamne.png" alt="" width="667" height="478" /><p id="caption-attachment-70128" class="wp-caption-text">A DNS lookup on the domain az.mastercard.com on Jan. 14, 2025 shows the mistyped domain name a22-65.akam.ne.</p></div>
<p>From June 30, 2020 until January 14, 2025, one of the core Internet servers that MasterCard uses to direct traffic for portions of the mastercard.com network was misnamed. MasterCard.com relies on five shared Domain Name System (DNS) servers at the Internet infrastructure provider <strong>Akamai </strong>[DNS acts as a kind of Internet phone book, by translating website names to numeric Internet addresses that are easier for computers to manage].</p>
<p>All of the Akamai DNS server names that MasterCard uses are supposed to end in &#8220;akam.net&#8221; but one of them was misconfigured to rely on the domain &#8220;<strong>akam.ne</strong>.&#8221;</p>
<p>This tiny but potentially critical typo was discovered recently by <strong>Philippe Caturegli</strong>, founder of the security consultancy <a href="https://www.seralys.com/" target="_blank" rel="noopener">Seralys</a>. Caturegli said he guessed that nobody had yet registered the domain akam.ne, which is under the purview of the top-level domain authority for the West Africa nation of <a href="https://en.wikipedia.org/wiki/Niger" target="_blank" rel="noopener">Niger</a>.</p>
<p>Caturegli said it took $300 and nearly three months of waiting to secure the domain with the registry in Niger. After enabling a DNS server on akam.ne, he noticed hundreds of thousands of DNS requests hitting his server each day from locations around the globe. Apparently, MasterCard wasn&#8217;t the only organization that had fat-fingered a DNS entry to include &#8220;akam.ne,&#8221; but they were by far the largest.</p>
<p>Had he enabled an email server on his new domain akam.ne, Caturegli likely would have received wayward emails directed toward mastercard.com or other affected domains. If he&#8217;d abused his access, he probably could have <a href="https://krebsonsecurity.com/2024/08/local-networks-go-global-when-domain-names-collide/" target="_blank" rel="noopener">obtained website encryption certificates (SSL/TLS certs)</a> that were authorized to accept and relay web traffic for affected websites. He may even have been able to <a href="https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/" target="_blank" rel="noopener">passively receive Microsoft Windows authentication credentials</a> from employee computers at affected companies.</p>
<p>But the researcher said he didn&#8217;t attempt to do any of that. Instead, he alerted MasterCard that the domain was theirs if they wanted it, copying this author on his notifications. A few hours later, MasterCard acknowledged the mistake, but said there was never any real threat to the security of its operations.</p>
<p>&#8220;We have looked into the matter and there was not a risk to our systems,&#8221; a MasterCard spokesperson wrote. &#8220;This typo has now been corrected.&#8221;</p>
<p>Meanwhile, Caturegli received a request submitted through <strong>Bugcrowd</strong>, a program that offers financial rewards and recognition to security researchers who find flaws and work privately with the affected vendor to fix them. The message suggested his public disclosure of the MasterCard DNS error via <a href="https://www.linkedin.com/feed/update/urn:li:activity:7285038365236682753/" target="_blank" rel="noopener">a post on LinkedIn</a> (after he&#8217;d secured the akam.ne domain) was not aligned with ethical security practices, and passed on a request from MasterCard to have the post removed.</p>
<div id="attachment_70126" style="width: 718px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70126" decoding="async" loading="lazy" class="size-full wp-image-70126" src="media/1101b55f.mastercard-response.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/mastercard-response.png" alt="" width="708" height="855" /><p id="caption-attachment-70126" class="wp-caption-text">MasterCard&#8217;s request to Caturegli, a.k.a. &#8220;Titon&#8221; on infosec.exchange.</p></div>
<p>Caturegli said while he does have an account on Bugcrowd, he has never submitted anything through the Bugcrowd program, and that he reported this issue directly to MasterCard.</p>
<p>&#8220;I did not disclose this issue through Bugcrowd,&#8221; Caturegli wrote in reply. &#8220;Before making any public disclosure, I ensured that the affected domain was registered to prevent exploitation, mitigating any risk to MasterCard or its customers. This action, which we took at our own expense, demonstrates our commitment to ethical security practices and responsible disclosure.&#8221; <span id="more-70117"></span></p>
<p>Most organizations have at least two authoritative domain name servers, but some handle so many DNS requests that they need to spread the load over additional DNS server domains. In MasterCard&#8217;s case, that number is five, so it stands to reason that if an attacker managed to seize control over just one of those domains they would only be able to see about one-fifth of the overall DNS requests coming in.</p>
<p>But Caturegli said the reality is that many Internet users are relying at least to some degree on public traffic forwarders or DNS resolvers like <strong>Cloudflare</strong> and <strong>Google</strong>.</p>
<p>&#8220;So all we need is for one of these resolvers to query our name server and cache the result,&#8221; Caturegli said. By setting their DNS server records with a long TTL or &#8220;Time To Live&#8221; &#8212; a setting that can adjust the lifespan of data packets on a network &#8212; an attacker&#8217;s poisoned instructions for the target domain can be propagated by large cloud providers.</p>
<p>&#8220;With a long TTL, we may reroute a LOT more than just 1/5 of the traffic,&#8221; he said.</p>
<p>The researcher said he&#8217;d hoped that the credit card giant might thank him, or at least offer to cover the cost of buying the domain.</p>
<p>&#8220;We obviously disagree with this assessment,&#8221; Caturegli wrote in <a href="https://www.linkedin.com/feed/update/urn:li:activity:7285038365236682753?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7285038365236682753%2C7285289297706909697%29&amp;dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287285289297706909697%2Curn%3Ali%3Aactivity%3A7285038365236682753%29" target="_blank" rel="noopener">a follow-up post</a> on LinkedIn regarding MasterCard&#8217;s public statement. &#8220;But we’ll let you judge— here are some of the DNS lookups we recorded before reporting the issue.&#8221;</p>
<div id="attachment_70125" style="width: 800px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70125" decoding="async" loading="lazy" class="size-full wp-image-70125" src="media/d893e62b.mastercard-domains.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/mastercard-domains.png" alt="" width="790" height="561" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/mastercard-domains.png 790w, https://krebsonsecurity.com/wp-content/uploads/2025/01/mastercard-domains-768x545.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/mastercard-domains-782x555.png 782w, https://krebsonsecurity.com/wp-content/uploads/2025/01/mastercard-domains-100x70.png 100w" sizes="(max-width: 790px) 100vw, 790px" /><p id="caption-attachment-70125" class="wp-caption-text">Caturegli posted this screenshot of MasterCard domains that were potentially at risk from the misconfigured domain.</p></div>
<p>As the screenshot above shows, the misconfigured DNS server Caturegli found involved the MasterCard subdomain <strong>az.mastercard.com</strong>. It is not clear exactly how this subdomain is used by MasterCard, however their naming conventions suggest the domains correspond to production servers at Microsoft&#8217;s <strong>Azure</strong> cloud service. Caturegli said the domains all resolve to Internet addresses at Microsoft.</p>
<p>&#8220;Don’t be like Mastercard,&#8221; Caturegli concluded in his LinkedIn post. &#8220;Don’t dismiss risk, and don’t let your marketing team handle security disclosures.&#8221;</p>
<p>One final note: The domain akam.ne has been registered previously &#8212; in December 2016 by someone using the email address um-i-delo@yandex.ru. The Russian search giant Yandex reports this user account belongs to an &#8220;Ivan I.&#8221; from Moscow. Passive DNS records from <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> show that between 2016 and 2018 the domain was connected to an Internet server in Germany, and that the domain was left to expire in 2018.</p>
<p>This is interesting given <a href="https://www.linkedin.com/feed/update/urn:li:activity:7285038365236682753?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7285038365236682753%2C7285221445796835329%29&amp;replyUrn=urn%3Ali%3Acomment%3A%28activity%3A7285038365236682753%2C7285223757982363648%29&amp;dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287285221445796835329%2Curn%3Ali%3Aactivity%3A7285038365236682753%29&amp;dashReplyUrn=urn%3Ali%3Afsd_comment%3A%287285223757982363648%2Curn%3Ali%3Aactivity%3A7285038365236682753%29" target="_blank" rel="noopener">a comment on Caturegli&#8217;s LinkedIn post from an ex-Cloudflare employee</a> who linked to a report he co-authored on a similar typo domain apparently registered in 2017 for organizations that may have mistyped their AWS DNS server as &#8220;<strong>awsdns-06.ne</strong>&#8221; instead of &#8220;<strong>awsdns-06.net</strong>.&#8221; DomainTools reports that this typo domain also was registered to a Yandex user (playlotto@yandex.ru), and was hosted at the same German ISP &#8212; Team Internet (AS61969).</p>


feed_id: https://krebsonsecurity.com/?p=70172
title: A Tumultuous Week for Federal Cybersecurity Efforts
uri: A-Tumultuous-Week-for-Federal-Cybersecurity-Efforts
url: https://krebsonsecurity.com/2025/01/a-tumultuous-week-for-federal-cybersecurity-efforts/
content:
<div id="attachment_70185" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70185" decoding="async" class=" wp-image-70185" src="media/f8c41051.whitehousenight.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/whitehousenight.png" alt="" width="751" height="495" /><p id="caption-attachment-70185" class="wp-caption-text">Image: Shutterstock. Greg Meland.</p></div>
<p><strong>President Trump</strong> last week issued a flurry of executive orders that upended a number of government initiatives focused on improving the nation&#8217;s cybersecurity posture. The president fired all advisors from the Department of Homeland Security&#8217;s Cyber Safety Review Board, called for the creation of a strategic cryptocurrency reserve, and voided a Biden administration action that sought to reduce the risks that artificial intelligence poses to consumers, workers and national security.</p>
<p>On his first full day back in the White House, Trump dismissed all 15 advisory committee members of the <a href="https://en.wikipedia.org/wiki/Cyber_Safety_Review_Board" target="_blank" rel="noopener">Cyber Safety Review Board</a> (CSRB), a nonpartisan government entity established in February 2022 with a mandate to investigate the causes of major cybersecurity events. The CSRB has so far produced three detailed reports, including an analysis of the <a href="https://www.wired.com/story/log4j-log4shell/" target="_blank" rel="noopener">Log4Shell vulnerability</a> crisis, attacks from <a href="https://krebsonsecurity.com/tag/lapsus/" target="_blank" rel="noopener">the cybercrime group LAPSUS$</a>, and the 2023 <a href="https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion" target="_blank" rel="noopener">Microsoft Exchange Online breach</a>.</p>
<p>The CSRB was in the midst of an inquiry into cyber intrusions uncovered recently across a broad spectrum of U.S. telecommunications providers at the hands of Chinese state-sponsored hackers. One of the CSRB&#8217;s most recognizable names is <strong>Chris Krebs </strong>(no relation), the former director of the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA). Krebs was fired by President Trump in November 2020 for declaring the presidential contest was the most secure in American history, and for refuting Trump&#8217;s false claims of election fraud.</p>
<p>South Dakota Governor <strong>Kristi Noem</strong>, confirmed by the U.S. Senate last week as the new director of the DHS, criticized CISA at her confirmation hearing, <em>TheRecord</em> <a href="https://therecord.media/kristi-noem-cisa-smaller-nimble?utm_medium=email&amp;_hsenc=p2ANqtz-80A9JU5jFUojRnewo-h4MRW17b74bMAW6oR5rGLelMqQ7jRJp3Ors1qYeq5RFK2jrpXM9V5J2o-RGJSorsePm_8KCvoZ8nFsrOw8h_pdBDQggry0c&amp;_hsmi=343361648&amp;utm_content=343361495&amp;utm_source=hs_email" target="_blank" rel="noopener">reports</a>.</p>
<p>Noem told lawmakers CISA needs to be &#8220;much more effective, smaller, more nimble, to really fulfill their mission,&#8221; which she said should be focused on hardening federal IT systems and hunting for digital intruders. Noem said the agency&#8217;s work on fighting misinformation shows it has &#8220;gotten far off mission&#8221; and involved &#8220;using their resources in ways that was never intended.&#8221;</p>
<p>&#8220;The misinformation and disinformation that they have stuck their toe into and meddled with, should be refocused back onto what their job is,&#8221; she said.</p>
<p><strong>Moses Frost</strong>, a cybersecurity instructor with the SANS Institute, compared the sacking of the CSRB members to firing all of the experts at the <strong>National Transportation Safety Board</strong> (NTSB) while they&#8217;re in the middle of an investigation into a string of airline disasters.</p>
<p>&#8220;I don’t recall seeing an &#8216;NTSB Board&#8217; being fired during the middle of a plane crash investigation,&#8221; Frost said in a recent SANS newsletter. &#8220;I can say that the attackers in the phone companies will not stop because the review board has gone away. We do need to figure out how these attacks occurred, and CISA did appear to be doing some good for the vast majority of the federal systems.&#8221;</p>
<p>Speaking of transportation, <em>The Record</em> notes that Transportation Security Administration chief <strong>David Pekoske</strong> <a href="https://therecord.media/tsa-chief-behind-cyber-directives-ousted-trump-administration?utm_medium=email&amp;_hsenc=p2ANqtz-_a5PHD4Ff2FlOiHIlYbcfVNbftiTItDbxlH5TxzCLZicEcan3et6L6nmVmhC57_5AXp-a1k45WwHO6jbVxejLlMjPtTTdVzGtbreDzSl6fzHhGdkg&amp;_hsmi=343497657&amp;utm_content=343496082&amp;utm_source=hs_email" target="_blank" rel="noopener">was fired</a> despite overseeing critical cybersecurity improvements across pipeline, rail and aviation sectors. Pekoske was appointed by Trump in 2017 and had his 5-year tenure renewed in 2022 by former President Joe Biden.</p>
<h2>AI &amp; CRYPTOCURRENCY</h2>
<p>Shortly after being sworn in for a second time, Trump voided a Biden executive order that focused on supporting research and development in artificial intelligence. The previous administration&#8217;s order on AI was crafted with an eye toward managing <a href="https://www.ic3.gov/PSA/2024/PSA241203" target="_blank" rel="noopener">the safety and security risks introduced by the technology</a>. But a <a href="https://www.whitehouse.gov/fact-sheets/2025/01/fact-sheet-president-donald-j-trump-takes-action-to-enhance-americas-ai-leadership/" target="_blank" rel="noopener">statement</a> released by the White House said Biden&#8217;s approach to AI had hindered development, and that the United States would support AI systems that are &#8220;free from ideological bias or engineered social agendas,&#8221; to maintain leadership.</p>
<p>The Trump administration issued <a href="https://www.whitehouse.gov/fact-sheets/2025/01/fact-sheet-executive-order-to-establish-united-states-leadership-in-digital-financial-technology/" target="_blank" rel="noopener">its own executive order on AI</a>, which calls for an &#8220;AI Action Plan&#8221; to be led by the assistant to the president for science and technology, the White House &#8220;AI &amp; crypto czar,&#8221; and the national security advisor. It also directs the White House to revise and reissue policies to federal agencies on the government&#8217;s acquisition and governance of AI &#8220;to ensure that harmful barriers to America&#8217;s AI leadership are eliminated.&#8221;</p>
<p>Trump&#8217;s AI &amp; crypto czar is <strong>David Sacks</strong>, an entrepreneur and Silicon Valley venture capitalist who argues that the Biden administration&#8217;s approach to AI and cryptocurrency has driven innovation overseas. Sacks recently asserted that non-fungible cryptocurrency tokens and memecoins are neither securities nor commodities, but rather should be treated as &#8220;collectibles&#8221; like baseball cards and stamps.</p>
<p><span class="s1">There is already a legal definition of collectibles under the U.S. tax code that applies to things like art or antiques, which can be be subject to high capital gains taxes. But <strong>Joe Hall</strong>, a capital markets attorney and partner at Davis Polk, <a href="https://finance.yahoo.com/news/crypto-czar-david-sacks-says-224508277.html?guccounter=1&amp;guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&amp;guce_referrer_sig=AQAAAL0Zay1PbdGAe14O3Q6FoNdB1zkg6wbzSRDfb7oPUC6Wd6zrQ6vU2RRSCVbDRAzdKV-8hUw3m5wdMKoCzprArK-YuIyoeEjJwTP3ZNk1AoW8dVIhp4KFD3-c9i7NrrUPaY3u2e2yLSFfzlqeJDnJ55BTbyBLHx9pM_KywC0pCxWf" target="_blank" rel="noopener">told <em>Fortune</em></a> there are</span> no market regulations that apply to collectibles under U.S. securities law. Hall said Sacks’ comments “suggest a viewpoint that it would not be appropriate to regulate these things the way we regulate securities.”</p>
<p>The new administration&#8217;s position makes sense considering that the Trump family is deeply and personally invested in a number of recent memecoin ventures that have attracted billions from investors. President Trump and First Lady Melania Trump each launched their own vanity memecoins this month, dubbed <strong>$TRUMP</strong> and <strong>$MELANIA</strong>.</p>
<p><em>The Wall Street Journal</em> <a href="https://www.wsj.com/finance/trump-meme-coin-crypto-explained-c881afff" target="_blank" rel="noopener">reported Thursday</a> the market capitalization of $TRUMP stood at about $7 billion, down from a peak of near $15 billion, while $MELANIA is hovering somewhere in the $460 million mark. Just two months before the 2024 election, Trump&#8217;s three sons debuted a cryptocurrency token called <strong>World Liberty Financial</strong>.</p>
<p>Despite maintaining a considerable personal stake in how cryptocurrency is regulated, Trump issued <a href="https://www.whitehouse.gov/fact-sheets/2025/01/fact-sheet-executive-order-to-establish-united-states-leadership-in-digital-financial-technology/" target="_blank" rel="noopener">an executive order on January 23</a> calling for a working group to be chaired by Sacks that would develop &#8220;a federal regulatory framework governing digital assets, including stablecoins,&#8221; and evaluate the creation of a &#8220;strategic national digital assets stockpile.&#8221;</p>
<p>Translation: Using taxpayer dollars to prop up the speculative, volatile, and highly risky cryptocurrency industry, which has been marked by endless scams, rug-pulls, 8-figure cyber heists, rampant fraud, and unrestrained innovations in money laundering.<span id="more-70172"></span></p>
<h2>WEAPONIZATION &amp; DISINFORMATION</h2>
<p>Prior to the election, President Trump frequently vowed to use a second term to exact retribution against his perceived enemies. Part of that promise materialized in an executive order Trump issued last week titled &#8220;<a href="https://www.whitehouse.gov/presidential-actions/2025/01/ending-the-weaponization-of-the-federal-government/" target="_blank" rel="noopener">Ending the Weaponization of the Federal Government</a>,&#8221; which decried &#8220;an unprecedented, third-world weaponization of prosecutorial power to upend the democratic process,&#8221; in the prosecution of more than 1,500 people who invaded the U.S. Capitol on Jan. 6, 2021.</p>
<p>On Jan. 21, Trump <a href="https://www.nbcnews.com/politics/justice-department/trump-set-pardon-defendants-stormed-capitol-jan-6-2021-rcna187735" target="_blank" rel="noopener">commuted the sentences</a> of several leaders of the Proud Boys and Oath Keepers who were convicted of seditious conspiracy. He also issued &#8220;a full, complete and unconditional pardon to all other individuals convicted of offenses related to events that occurred at or near the United States Capitol on January 6, 2021,&#8221; which include those who assaulted law enforcement officers.</p>
<p>The New York Times <a href="https://www.nytimes.com/2025/01/20/us/politics/weaponization-government-executive-order-trump.html" target="_blank" rel="noopener">reports</a> &#8220;the language of the document suggests — but does not explicitly state — that the Trump administration review will examine the actions of local district attorneys or state officials, such as the district attorneys in Manhattan or Fulton County, Ga., or the New York attorney general, all of whom filed cases against President Trump.&#8221;</p>
<p>Another Trump order called &#8220;<a href="https://www.whitehouse.gov/presidential-actions/2025/01/restoring-freedom-of-speech-and-ending-federal-censorship/" target="_blank" rel="noopener">Restoring Freedom of Speech and Ending Federal Censorship</a>&#8221; asserts:</p>
<p>&#8220;Over the last 4 years, the previous administration trampled free speech rights by censoring Americans’ speech on online platforms, often by exerting substantial coercive pressure on third parties, such as social media companies, to moderate, deplatform, or otherwise suppress speech that the Federal Government did not approve,&#8221; the Trump administration alleged. &#8220;Under the guise of combatting &#8216;misinformation,&#8217; &#8216;disinformation,&#8217; and &#8216;malinformation,&#8217; the Federal Government infringed on the constitutionally protected speech rights of American citizens across the United States in a manner that advanced the Government’s preferred narrative about significant matters of public debate.&#8221;</p>
<p>Both of these executive orders have <a href="https://bsky.app/profile/katestarbird.bsky.social/post/3kdu7ucy3jd2f" target="_blank" rel="noopener">potential implications</a> for security, privacy and civil liberties activists who have sought to track conspiracy theories and raise awareness about disinformation efforts on social media coming from U.S. adversaries.</p>
<p>In the wake of the 2020 election, Republicans created the <strong>House Judiciary Committee&#8217;s Select Subcommittee on the Weaponization of the Federal Government</strong>. Led by GOP <strong>Rep. Jim Jordan</strong> of Ohio, the committee&#8217;s stated purpose was to investigate alleged collusion between the Biden administration and tech companies to unconstitutionally shut down political speech.</p>
<p>The GOP committee focused much of its ire at members of the short-lived <a href="https://en.wikipedia.org/wiki/Disinformation_Governance_Board" target="_blank" rel="noopener">Disinformation Governance Board</a>, an advisory board to DHS created in 2022 (the &#8220;combating misinformation, disinformation, and malinformation&#8221; quote from Trump&#8217;s executive order is a reference to the board&#8217;s stated mission). Conservative groups seized on social media posts made by the director of the board, who <a href="https://www.npr.org/2022/05/21/1100438703/dhs-disinformation-board-nina-jankowicz" target="_blank" rel="noopener">resigned</a> after facing death threats. The board was dissolved by DHS soon after.</p>
<p>In his first administration, President Trump created a special prosecutor to probe the origins of the FBI&#8217;s investigation into possible collusion between the Trump campaign and Russian operatives seeking to influence the 2016 election. Part of that inquiry examined evidence gathered by some of the world’s most renowned cybersecurity experts who identified <a href="https://krebsonsecurity.com/2021/09/lawsuits-indictments-revive-trump-alfa-bank-story/" target="_blank" rel="noopener">frequent and unexplained communications</a> between an email server used by the <strong>Trump Organization</strong> and <strong>Alfa Bank</strong>, one of Russia’s largest financial institutions.</p>
<p>Trump&#8217;s Special Prosecutor <strong>John Durham</strong> later subpoenaed and/or deposed dozens of security experts who&#8217;d collected, viewed or merely commented on the data. Similar harassment and deposition demands would come from lawyers for Alfa Bank. Durham ultimately indicted <strong>Michael Sussman</strong>, the former federal cybercrime prosecutor who reported the oddity to the FBI. Sussman was acquitted in May 2022. Last week, Trump appointed Durham to lead the U.S. attorney&#8217;s office in Brooklyn, NY.</p>
<p><strong>Quinta Jurecic</strong> at <em>Lawfare</em> <a href="https://www.lawfaremedia.org/article/what-do-trump-s-weaponization-and-censorship-executive-orders-actually-do" target="_blank" rel="noopener">notes</a> that while the executive actions are ominous, they are also vague, and could conceivably generate either a campaign of retaliation, or nothing at all.</p>
<p>&#8220;The two orders establish that there will be investigations but leave open the questions of what kind of investigations, what will be investigated, how long this will take, and what the consequences might be,&#8221; Jurecic wrote. &#8220;It is difficult to draw firm conclusions as to what to expect. Whether this ambiguity is intentional or the result of sloppiness or disagreement within Trump’s team, it has at least one immediate advantage as far as the president is concerned: generating fear among the broad universe of potential subjects of those investigations.&#8221;</p>
<p>On Friday, Trump moved <a href="https://www.lawfaremedia.org/article/trump-fired-17-inspectors-general-was-it-legal" target="_blank" rel="noopener">to fire at least 17 inspectors general</a>, the government watchdogs who conduct audits and investigations of executive branch actions, and who often uncover instances of government waste, fraud and abuse. Lawfare&#8217;s <strong>Jack Goldsmith</strong> argues that the removals are probably legal even though Trump defied a 2022 law that required congressional notice of the terminations, which Trump did not give.</p>
<p>&#8220;Trump probably acted lawfully, I think, because the notice requirement is probably unconstitutional,&#8221; Goldsmith wrote. &#8220;The real bite in the 2022 law, however, comes in the limitations it places on Trump’s power <em>to replace</em> the terminated IGs—limitations that I believe are constitutional. This aspect of the law will make it hard, but not impossible, for Trump to put loyalists atop the dozens of vacant IG offices around the executive branch. The ultimate fate of IG independence during Trump 2.0, however, depends less on legal protections than on whether Congress, which traditionally protects IGs, stands up for them now. Don’t hold your breath.&#8221;</p>
<p>Among the many Biden administration executive orders revoked by President Trump last week was an action from December 2021 establishing the <strong>United States Council on Transnational Organized Crime</strong>, which is charged with advising the White House on a range of criminal activities, including drug and weapons trafficking, migrant smuggling, human trafficking, cybercrime, intellectual property theft, money laundering, wildlife and timber trafficking, illegal fishing, and illegal mining.</p>
<p>So far, the White House doesn&#8217;t appear to have revoked <a href="https://web.archive.org/web/20250117143627/https://www.whitehouse.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/" target="_blank" rel="noopener">an executive order</a> that former President Biden issued less than a week before President Trump took office. On Jan. 16, 2025, Biden released a directive that focused on improving the security of federal agencies and contractors, and giving the government more power to sanction the hackers who target critical infrastructure.</p>


feed_id: https://krebsonsecurity.com/?p=70065
title: Infrastructure Laundering: Blending in with the Cloud
uri: Infrastructure-Laundering-Blending-in-with-the-Cloud
url: https://krebsonsecurity.com/2025/01/infrastructure-laundering-blending-in-with-the-cloud/
content:
<div id="attachment_70230" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70230" decoding="async" class=" wp-image-70230" src="media/6d10ad7b.funnell-ss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss.png" alt="" width="749" height="452" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss.png 1319w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss-768x463.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss-782x472.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70230" class="wp-caption-text">Image: Shutterstock, ArtHead.</p></div>
<p>In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit &#8212; a sprawling network tied to Chinese organized crime gangs and aptly named &#8220;<strong>Funnull</strong>&#8221; &#8212; highlights a persistent whac-a-mole problem facing cloud services.</p>
<p>In October 2024, the security firm <strong>Silent Push</strong> published a <a href="https://www.silentpush.com/blog/triad-nexus-funnull/" target="_blank" rel="noopener">lengthy analysis</a> of how <strong>Amazon AWS</strong> and <strong>Microsoft Azure</strong> were providing services to Funnull, a two-year-old Chinese content delivery network that hosts a wide variety of fake trading apps, <a href="https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/" target="_blank" rel="noopener">pig butchering scams</a>, gambling websites, and retail phishing pages.</p>
<p>Funnull made headlines last summer after it acquired the domain name <strong>polyfill[.]io</strong>, previously the home of a widely-used open source code library that allowed older browsers to handle advanced functions that weren&#8217;t natively supported. There were still tens of thousands of legitimate domains linking to the Polyfill domain at the time of its acquisition, and Funnull soon after <a href="https://arstechnica.com/security/2024/07/384000-sites-link-to-code-library-caught-performing-supply-chain-attack/" target="_blank" rel="noopener">conducted a supply-chain attack that redirected visitors to malicious sites</a>.</p>
<p>Silent Push&#8217;s October 2024 report found a vast number of domains hosted via Funnull promoting gambling sites that bear the logo of the <strong>Suncity Group</strong>, a Chinese entity named in <a href="media/62b24cf9.Casino_Underground_Banking_Report_2024.pdf" data-original-source="https://www.unodc.org/roseap/uploads/documents/Publications/2024/Casino_Underground_Banking_Report_2024.pdf" target="_blank" rel="noopener">a 2024 UN report</a> (PDF) for laundering millions of dollars for the North Korean <a href="https://en.wikipedia.org/wiki/Lazarus_Group" target="_blank" rel="noopener">Lazarus Group</a>.</p>
<p>In 2023, Suncity’s CEO was <a href="https://www.smh.com.au/business/companies/ex-suncity-boss-alvin-chau-jailed-for-18-years-in-macau-20230118-p5cdmj.html" target="_blank" rel="noopener">sentenced to 18 years in prison</a> on charges of fraud, illegal gambling, and “<a href="https://en.wikipedia.org/wiki/Triad_(organized_crime)" target="_blank" rel="noopener">triad</a> offenses,” i.e. working with Chinese transnational organized crime syndicates. Suncity is alleged to have built an underground banking system that <a href="https://macaonews.org/news/city/former-suncity-boss-alvin-chau-sentenced-to-18-years-in-prison/" target="_blank" rel="noopener">laundered billions of dollars for criminals</a>.</p>
<p>It is likely the gambling sites coming through Funnull are abusing top casino brands as part of their money laundering schemes. In reporting on Silent Push&#8217;s October report, <em>TechCrunch</em> <a href="https://techcrunch.com/2024/10/22/researchers-link-polyfill-supply-chain-attack-to-huge-network-of-copycat-gambling-sites/" target="_blank" rel="noopener">obtained</a> a comment from Bwin, one of the casinos being advertised en masse through Funnull, and Bwin said those websites did not belong to them.</p>
<p>Gambling is illegal in China except in Macau, a special administrative region of China. Silent Push researchers say Funnull may be helping online gamblers in China evade the Communist party&#8217;s &#8220;Great Firewall,&#8221; which blocks access to gambling destinations.</p>
<p>Silent Push&#8217;s <strong>Zach Edwards</strong> said that upon revisiting Funnull&#8217;s infrastructure again this month, they found dozens of the same Amazon and Microsoft cloud Internet addresses still forwarding Funnull traffic through a dizzying chain of auto-generated domain names before redirecting malicious or phishous websites.</p>
<p>Edwards said Funnull is a textbook example of an increasing trend Silent Push calls &#8220;infrastructure laundering,&#8221; wherein crooks selling cybercrime services will relay some or all of their malicious traffic through U.S. cloud providers.</p>
<p>&#8220;It&#8217;s crucial for global hosting companies based in the West to wake up to the fact that extremely low quality and suspicious web hosts based out of China are deliberately renting IP space from multiple companies and then mapping those IPs to their criminal client websites,&#8221; Edwards told KrebsOnSecurity. &#8220;We need these major hosts to create internal policies so that if they are renting IP space to one entity, who further rents it to host numerous criminal websites, all of those IPs should be reclaimed and the CDN who purchased them should be banned from future IP rentals or purchases.&#8221;</p>
<div id="attachment_70232" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70232" decoding="async" loading="lazy" class=" wp-image-70232" src="media/a09d776f.suncity-funnull.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/suncity-funnull.png" alt="" width="750" height="370" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/suncity-funnull.png 958w, https://krebsonsecurity.com/wp-content/uploads/2025/01/suncity-funnull-768x379.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/suncity-funnull-782x386.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70232" class="wp-caption-text">A Suncity gambling site promoted via Funnull. The sites feature a prompt for a Tether/USDT deposit program.</p></div>
<p>Reached for comment, Amazon referred this reporter to a statement Silent Push included in <a href="https://www.silentpush.com/blog/infrastructure-laundering" target="_blank" rel="noopener">a report released today</a>. Amazon said AWS was already aware of the Funnull addresses tracked by Silent Push, and that it had suspended all known accounts linked to the activity.</p>
<p>Amazon said that contrary to implications in the Silent Push report, it has every reason to aggressively police its network against infrastructure laundering, noting the accounts tied to Funnull used &#8220;fraudulent methods to temporarily acquire infrastructure, for which it never pays. Thus, AWS incurs damages as a result of the abusive activity.&#8221;</p>
<p>&#8220;When AWS&#8217;s automated or manual systems detect potential abuse, or when we receive reports of potential abuse, we act quickly to investigate and take action to stop any prohibited activity,&#8221; Amazon&#8217;s statement continues. &#8220;In the event anyone suspects that AWS resources are being used for abusive activity, we encourage them to report it to AWS Trust &amp; Safety using the <a href="https://support.aws.amazon.com/#/contacts/report-abuse" target="_blank" rel="noopener">report abuse form</a>. In this case, the authors of the report never notified AWS of the findings of their research via our easy-to-find security and abuse reporting channels. Instead, AWS first learned of their research from a journalist to whom the researchers had provided a draft.&#8221;</p>
<p>Microsoft likewise said it takes such abuse seriously, and encouraged others to report suspicious activity found on its network.</p>
<p>&#8220;We are committed to protecting our customers against this kind of activity and actively enforce acceptable use policies when violations are detected,&#8221; Microsoft said in a written statement. &#8220;We encourage <a href="https://protect.checkpoint.com/v2/r01/___https://msrc.microsoft.com/report/___.YzJ1OndlY29tbXVuaWNhdGlvbnM6YzpvOjQwMWQyNWE1OWIxMDNiNWUyZGQ5ZmY2MmZiYTMxMTNiOjc6NDRlNzoyZDg4NzY5MmI4MGVmYWY2M2NmZWVjOGMxMjhkNTRhYjhmODc4Mzk3MjJkYjdkMTEzMjk0MDdmMzA4NDUxNDczOmg6VDpG" target="_blank" rel="noopener">reporting</a> suspicious activity to Microsoft so we can investigate and take appropriate actions.&#8221;<span id="more-70065"></span></p>
<p><strong>Richard Hummel</strong> is threat intelligence lead at <strong>NETSCOUT</strong>. Hummel said it used to be that &#8220;noisy&#8221; and frequently disruptive malicious traffic &#8212; such as automated application layer attacks, and &#8220;brute force&#8221; efforts to crack passwords or find vulnerabilities in websites &#8212; came mostly from botnets, or large collections of hacked devices.</p>
<p>But he said the vast majority of the infrastructure used to funnel this type of traffic is now proxied through major cloud providers, which can make it difficult for organizations to block at the network level.</p>
<p>&#8220;From a defenders point of view, you can&#8217;t wholesale block cloud providers, because a single IP can host thousands or tens of thousands of domains,&#8221; Hummel said.</p>
<p>In May 2024, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">a deep dive on Stark Industries Solutions</a>, an ISP that materialized at the start of Russia&#8217;s invasion of Ukraine and has been used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia. Experts said much of the malicious traffic  traversing Stark&#8217;s network (e.g. vulnerability scanning and password brute force attacks) was being bounced through U.S.-based cloud providers.</p>
<p>Stark&#8217;s network has been a favorite of the Russian hacktivist group called <strong>NoName057(16)</strong>, which frequently launches huge distributed denial-of-service (DDoS) attacks against a variety of targets seen as opposed to Moscow. Hummel said NoName&#8217;s history suggests they are adept at cycling through new cloud provider accounts, making anti-abuse efforts into a game of whac-a-mole.</p>
<p>&#8220;It almost doesn&#8217;t matter if the cloud provider is on point and takes it down because the bad guys will just spin up a new one,&#8221; he said. &#8220;Even if they&#8217;re only able to use it for an hour, they&#8217;ve already done their damage. It&#8217;s a really difficult problem.&#8221;</p>
<p>Edwards said Amazon declined to specify whether the banned Funnull users were operating using compromised accounts or stolen payment card data, or something else.</p>
<p>&#8220;I&#8217;m surprised they wanted to lean into &#8216;We&#8217;ve caught this 1,200+ times and have taken these down!&#8217; and yet didn&#8217;t connect that each of those IPs was mapped to [the same] Chinese CDN,&#8221; he said. &#8220;We&#8217;re just thankful Amazon confirmed that account mules are being used for this and it isn&#8217;t some front-door relationship. We haven&#8217;t heard the same thing from Microsoft but it&#8217;s very likely that the same thing is happening.&#8221;</p>
<p>Funnull wasn&#8217;t always a bulletproof hosting network for scam sites. Prior to 2022, the network was known as <strong>Anjie CDN</strong>, based in the Philippines. One of Anjie&#8217;s properties was a website called <strong>funnull[.]app</strong>. Loading that domain reveals a pop-up message by the original Anjie CDN owner, who said their operations had been seized by an entity known as <strong>Fangneng CDN</strong> and <strong>ACB Group</strong>, the parent company of Funnull.</p>
<div id="attachment_70228" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70228" decoding="async" loading="lazy" class=" wp-image-70228" src="media/99ae34e7.funnull-app.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/funnull-app.png" alt="" width="749" height="533" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/funnull-app.png 1079w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnull-app-768x546.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnull-app-782x556.png 782w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnull-app-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70228" class="wp-caption-text">A machine-translated message from the former owner of Anjie CDN, a Chinese content delivery network that is now Funnull.</p></div>
<p>&#8220;After I got into trouble, the company was managed by my family,&#8221; the message explains. &#8220;Because my family was isolated and helpless, they were persuaded by villains to sell the company. Recently, many companies have contacted my family and threatened them, believing that Fangneng CDN used penetration and mirroring technology through customer domain names to steal member information and financial transactions, and stole customer programs by renting and selling servers. This matter has nothing to do with me and my family. Please contact Fangneng CDN to resolve it.&#8221;</p>
<p>In January 2024, the <strong>U.S. Department of Commerce</strong> issued <a href="https://www.federalregister.gov/documents/2024/01/29/2024-01580/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-malicious" target="_blank" rel="noopener">a proposed rule</a> that would require cloud providers to create a &#8220;Customer Identification Program&#8221; that includes procedures to collect data sufficient to determine whether each potential customer is a foreign or U.S. person.</p>
<p>According to the law firm <strong>Crowell &amp; Moring LLP</strong>, the Commerce rule also would require &#8220;infrastructure as a service&#8221; (IaaS) providers to report knowledge of any transactions with foreign persons that might allow the foreign entity to train a large AI model with potential capabilities that could be used in malicious cyber-enabled activity.</p>
<p>&#8220;The proposed rulemaking has garnered global attention, as its cross-border data collection requirements are unprecedented in the cloud computing space,&#8221; Crowell <a href="https://www.crowell.com/en/insights/client-alerts/who-iaas-your-foreign-customer-department-of-commerce-proposes-foreign-customer-identification-requirements-for-us-iaas-providers" target="_blank" rel="noopener">wrote</a>. &#8220;To the extent the U.S. alone imposes these requirements, there is concern that U.S. IaaS providers could face a competitive disadvantage, as U.S. allies have not yet announced similar foreign customer identification requirements.&#8221;</p>
<p>It remains unclear if the new White House administration will push forward with the requirements. The Commerce action was mandated as part of an executive order President Trump issued a day before leaving office in January 2021.</p>


feed_id: https://krebsonsecurity.com/?p=70250
title: FBI, Dutch Police Disrupt ‘Manipulaters’ Phishing Gang
uri: FBI-Dutch-Police-Disrupt-Manipulaters-Phishing-Gang
url: https://krebsonsecurity.com/2025/01/fbi-dutch-police-disrupt-manipulaters-phishing-gang/
content:
<p>The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname &#8220;<strong>The Manipulaters</strong>,&#8221; have been the subject of three stories published here since 2015. The FBI said the main clientele are organized crime groups that try to trick victim companies into making payments to a third party.</p>
<div id="attachment_56857" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56857" decoding="async" class=" wp-image-56857" src="media/590fabbd.ftexploit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit.png" alt="" width="749" height="530" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit.png 1208w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit-768x544.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit-782x553.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-56857" class="wp-caption-text">One of several current Fudtools sites run by the principals of The Manipulators.</p></div>
<p>On January 29, the FBI and the Dutch national police seized the technical infrastructure for a cybercrime service marketed under the brands <strong>Heartsender</strong>, <strong>Fudpage</strong> and <strong>Fudtools</strong> (and many other &#8220;fud&#8221; variations). The &#8220;fud&#8221; bit stands for &#8220;Fully Un-Detectable,&#8221; and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances.</p>
<p>The Dutch authorities <a href="https://www.politie.nl/nieuws/2025/januari/27/09-verstoringsactie-deelt-klap-uit-aan-crimineel-cybernetwerk-heartsender.html" target="_blank" rel="noopener">said</a> 39 servers and domains abroad were seized, and that the servers contained millions of records from victims worldwide &#8212; including at least 100,000 records pertaining to Dutch citizens.</p>
<p>A <a href="https://www.justice.gov/usao-sdtx/pr/cybercrime-websites-selling-hacking-tools-transnational-organized-crime-groups-seized" target="_blank" rel="noopener">statement</a> from the <strong>U.S. Department of Justice</strong> refers to the cybercrime group as <strong>Saim Raza</strong>, after a pseudonym The Manipulaters communally used to promote their spam, malware and phishing services on social media.</p>
<p>&#8220;The Saim Raza-run websites operated as marketplaces that advertised and facilitated the sale of tools such as phishing kits, scam pages and email extractors often used to build and maintain fraud operations,&#8221; the DOJ explained.</p>
<p>The core Manipulaters product is <strong>Heartsender</strong>, a spam delivery service whose homepage openly advertised phishing kits targeting users of various Internet companies, including <strong>Microsoft 365</strong>, <strong>Yahoo</strong>, <strong>AOL</strong>, <strong>Intuit</strong>, <strong>iCloud</strong> and <strong>ID.me</strong>, to name a few.</p>
<p>The government says transnational organized crime groups that purchased these services primarily used them to run <a href="https://krebsonsecurity.com/tag/business-email-compromise/" target="_blank" rel="noopener">business email compromise</a> (BEC) schemes, wherein the cybercrime actors tricked victim companies into making payments to a third party.</p>
<p>&#8220;Those payments would instead be redirected to a financial account the perpetrators controlled, resulting in significant losses to victims,&#8221; the DOJ wrote. &#8220;These tools were also used to acquire victim user credentials and utilize those credentials to further these fraudulent schemes. The seizure of these domains is intended to disrupt the ongoing activity of these groups and stop the proliferation of these tools within the cybercriminal community.&#8221;</p>
<div id="attachment_67010" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67010" decoding="async" loading="lazy" class=" wp-image-67010" src="media/e2748fd6.manipulaters-o365.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365.png" alt="" width="748" height="291" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365.png 1097w, https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365-768x299.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365-782x304.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-67010" class="wp-caption-text">Manipulaters advertisement for “Office 365 Private Page with Antibot” phishing kit sold via Heartsender. “Antibot” refers to functionality that attempts to evade automated detection techniques, keeping a phish deployed and accessible as long as possible. Image: DomainTools.</p></div>
<p>KrebsOnSecurity first wrote about The Manipulaters <a href="https://krebsonsecurity.com/2015/05/phishing-gang-is-audacious-manipulator/" target="_blank" rel="noopener">in May 2015</a>, mainly because their ads at the time were blanketing a number of popular cybercrime forums, and because they were fairly open and brazen about what they were doing &#8212; even who they were in real life.</p>
<p>We caught up with The Manipulaters again in 2021, with <a href="https://krebsonsecurity.com/2021/09/fudco-spam-empire-tied-to-pakistani-software-firm/" target="_blank" rel="noopener">a story</a> that found the core employees had started a web coding company in Lahore called <strong>WeCodeSolutions</strong> &#8212; presumably as a way to account for their considerable Heartsender income. That piece examined how WeCodeSolutions employees had all doxed themselves on Facebook by posting employee pictures from company parties each year featuring a large cake with the words <strong>FudCo</strong> written in icing.<span id="more-70250"></span></p>
<p>A <a href="https://krebsonsecurity.com/2024/04/the-manipulaters-improve-phishing-still-fail-at-opsec/" target="_blank" rel="noopener">follow-up story last year</a> about The Manipulaters prompted messages from various WeCodeSolutions employees who pleaded with this publication to remove stories about them. The Saim Raza identity told KrebsOnSecurity they were recently released from jail after being arrested and charged by local police, although they declined to elaborate on the charges.</p>
<p>The Manipulaters never seemed to care much about protecting their own identities, so it&#8217;s not surprising that they were unable or unwilling to protect their own customers. In <a href="https://www.domaintools.com/resources/blog/the-resurgence-of-the-manipulaters-team-breaking-heartsenders?utm_source=Krebs-on-Security" target="_blank" rel="noopener">an analysis</a> released last year, <strong>DomainTools.com</strong> found the web-hosted version of Heartsender leaked an extraordinary amount of user information to unauthenticated users, including customer credentials and email records from Heartsender employees.</p>
<div id="attachment_56860" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56860" decoding="async" loading="lazy" class=" wp-image-56860" src="media/8a798345.fudcocake.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png" alt="" width="751" height="773" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png 834w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-768x790.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-782x805.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-56860" class="wp-caption-text">Almost every year since their founding, The Manipulaters have posted a picture of a FudCo cake from a company party celebrating its anniversary.</p></div>
<p>DomainTools also uncovered evidence that the computers used by The Manipulaters were all infected with the same password-stealing malware, and that vast numbers of credentials were stolen from the group and sold online.</p>
<p>&#8220;Ironically, the Manipulaters may create more short-term risk to their own customers than law enforcement,&#8221; DomainTools wrote. &#8220;The data table &#8216;User Feedbacks&#8217; (sic) exposes what appear to be customer authentication tokens, user identifiers, and even a customer support request that exposes root-level SMTP credentials–all visible by an unauthenticated user on a Manipulaters-controlled domain.&#8221;</p>
<p>Police in The Netherlands said the investigation into the owners and customers of the service is ongoing.</p>
<p>&#8220;The Cybercrime Team is on the trail of a number of buyers of the tools,&#8221; the Dutch national police said. &#8220;Presumably, these buyers also include Dutch nationals. The investigation into the makers and buyers of this phishing software has not yet been completed with the seizure of the servers and domains.&#8221;</p>
<p>U.S. authorities this week also joined law enforcement in Australia, France, Greece, Italy, Romania, Spain in seizing a number of domains for several long-running cybercrime forums and services, including <strong>Cracked</strong> and <strong>Nulled</strong>. According to <a href="https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-takes-down-two-largest-cybercrime-forums-in-world" target="_blank" rel="noopener">a statement</a> from the European police agency <strong>Europol</strong>, the two communities attracted more than 10 million users in total.</p>
<p>Other domains seized as part of &#8220;<strong>Operation Talent</strong>&#8221; included <strong>Sellix</strong>, an e-commerce platform that was frequently used by cybercrime forum members to buy and sell illicit goods and services.</p>


feed_id: https://krebsonsecurity.com/?p=70279
title: Who’s Behind the Seized Forums ‘Cracked’ & ‘Nulled’?
uri: Who-s-Behind-the-Seized-Forums-Cracked-Nulled
url: https://krebsonsecurity.com/2025/02/whos-behind-the-seized-forums-cracked-nulled/
content:
<p>The <strong>FBI</strong> joined authorities across Europe last week in seizing domain names for <strong>Cracked</strong> and <strong>Nulled</strong>, English-language cybercrime forums with millions of users that trafficked in stolen data, hacking tools and malware. An investigation into the history of these communities shows their apparent co-founders quite openly operate an Internet service provider and a pair of e-commerce platforms catering to buyers and sellers on both forums.</p>
<div id="attachment_70283" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70283" decoding="async" class=" wp-image-70283" src="media/eed631b4.cracked-to.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/cracked-to.png" alt="" width="745" height="774" /><p id="caption-attachment-70283" class="wp-caption-text">In this 2019 post from Cracked, a forum moderator told the author of the post (Buddie) that the owner of the RDP service was the founder of Nulled, a.k.a. &#8220;Finndev.&#8221; Image: Ke-la.com.</p></div>
<p>On Jan. 30, the <strong>U.S. Department of Justice</strong> <a href="https://www.justice.gov/opa/pr/cracked-and-nulled-marketplaces-disrupted-international-cyber-operation" target="_blank" rel="noopener">said</a> it seized eight domain names that were used to operate Cracked, a cybercrime forum that sprang up in 2018 and attracted more than four million users. The DOJ said the law enforcement action, dubbed <a href="https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-takes-down-two-largest-cybercrime-forums-in-world" target="_blank" rel="noopener">Operation Talent</a>, also seized domains tied to <strong>Sellix</strong>, Cracked&#8217;s payment processor.</p>
<p>In addition, the government seized the domain names for two popular anonymity services that were heavily advertised on Cracked and Nulled and allowed customers to rent virtual servers: <a href="https://web.archive.org/web/20210924052821/https://starkrdp.io/imprint.php" target="_blank" rel="noopener">StarkRDP[.]io</a>, and <a href="https://web.archive.org/web/20210306133432/https://rdp.sh/imprint" target="_blank" rel="noopener">rdp[.]sh</a>.</p>
<p>Those archived webpages show both RDP services were owned by an entity called <strong>1337 Services Gmbh</strong>. According to <a href="https://www.northdata.com/1337%20Services%20GmbH,%20Hamburg/HRB%20164175" target="_blank" rel="noopener">corporate records</a> compiled by <strong>Northdata.com</strong>, 1337 Services GmbH is also known as <a href="https://web.archive.org/web/20211215172634/https://as210558.net/" target="_blank" rel="noopener"><strong>AS210558</strong></a> and is incorporated in Hamburg, Germany.</p>
<p>The Cracked forum administrator went by the nicknames &#8220;<strong>FlorainN</strong>&#8221; and &#8220;<strong>StarkRDP</strong>&#8221; on multiple cybercrime forums. Meanwhile, a <a href="https://www.linkedin.com/in/florian-m-095a0183/" target="_blank" rel="noopener">LinkedIn profile</a> for a <strong>Florian M</strong>. from Germany refers to this person as the co-founder of Sellix and founder of 1337 Services GmbH.</p>
<p>Northdata&#8217;s business profile for 1337 Services GmbH shows the company is controlled by two individuals: 32-year-old <strong>Florian Marzahl</strong> and <strong>Finn Alexander Grimpe</strong>, 28.</p>
<div id="attachment_70281" style="width: 759px" class="wp-caption aligncenter"><a href="media/026ccbf3.1337servicesGmbH.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70281" decoding="async" loading="lazy" class="wp-image-70281" src="media/026ccbf3.1337servicesGmbH.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH.png" alt="" width="749" height="312" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH.png 2234w, https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH-768x320.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH-1536x639.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH-2048x853.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2025/02/1337servicesGmbH-782x326.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-70281" class="wp-caption-text">An organization chart showing the owners of 1337 Services GmbH as Florian Marzahl and Finn Grimpe. Image: Northdata.com.</p></div>
<p>Neither Marzahl nor Grimpe responded to requests for comment. But Grimpe&#8217;s first name is interesting because it corresponds to the nickname chosen by the founder of Nulled, who goes by the monikers &#8220;<a href="https://web.archive.org/web/20150224213016/http://www.finn.lu/" target="_blank" rel="noopener">Finn</a>&#8221; and &#8220;<a href="https://github.com/finndev" target="_blank" rel="noopener">Finndev</a>.&#8221; NorthData reveals that Grimpe was the founder of a German entity called <strong>DreamDrive GmbH</strong>, which rented out <a href="https://web.archive.org/web/20210627121102/https://dreamdrive-rent.de/" target="_blank" rel="noopener">high-end sports cars and motorcycles</a>.</p>
<p>According to the cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, a user named Finndev registered on multiple cybercrime forums, including <strong>Raidforums</strong> [<a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">seized by the FBI in 2022</a>], <strong>Void[.]to</strong>, and <strong>vDOS</strong>, a DDoS-for-hire service that was <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank" rel="noopener">shut down in 2016 after its founders were arrested</a>.</p>
<p>The email address used for those accounts was <strong>f.grimpe@gmail.com</strong>. <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> reports f.grimpe@gmail.com was used to register at least nine domain names, including <strong>nulled[.]lol</strong> and <strong>nulled[.]it</strong>. Neither of these domains were among those seized in Operation Talent.</p>
<p>Intel471 finds the user FlorainN registered across multiple cybercrime forums using the email address <strong>olivia.messla@outlook.de</strong>. The breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> says this email address used the same password (and slight variations of it) across many accounts online &#8212; including at hacker forums &#8212; and that the same password was used in connection with dozens of other email addresses, such as <strong>florianmarzahl@hotmail.de, </strong>and <strong>fmarzahl137@gmail.com</strong>.<span id="more-70279"></span></p>
<p>The Justice Department said the Nulled marketplace had more than five million members, and has been selling stolen login credentials, stolen identification documents and hacking services, as well as tools for carrying out cybercrime and fraud, since 2016.</p>
<p>Perhaps fittingly, both Cracked and Nulled have been hacked over the years, exposing countless private messages between forum users. A review of those messages archived by Intel 471 showed that dozens of early forum members referred privately to Finndev as the owner of <strong>shoppy[.]gg</strong>, an e-commerce platform that caters to the same clientele as Sellix.</p>
<p>Shoppy was not targeted as part of Operation Talent, and its website remains online. Northdata <a href="https://www.northdata.com/Shoppy%20Ecommerce%20Ltd%C2%B7,%20Gan-Ner/ICA-515912517" target="_blank" rel="noopener">reports</a> that Shoppy&#8217;s business name &#8212; <strong>Shoppy Ecommerce Ltd.</strong> &#8212; is registered at an address in Gan-Ner, Israel, but there is no ownership information about this entity. Shoppy did not respond to requests for comment.</p>
<p>Constella found that a user named Shoppy registered on Cracked in 2019 using the email address <strong>finn@shoppy[.]gg</strong>. Constella says that email address is tied to <a href="https://x.com/shoppyecommerce" target="_blank" rel="noopener">a Twitter/X account</a> for Shoppy Ecommerce in Israel.</p>
<p>The DOJ said one of the alleged administrators of Nulled, a 29-year-old Argentinian national named <strong>Lucas Sohn</strong>, was arrested in Spain. The government has not announced any other arrests or charges associated with Operation Talent.</p>
<p>Indeed, both StarkRDP and FloraiN have posted to their accounts on <strong>Telegram</strong> that there were no charges levied against the proprietors of 1337 Services GmbH. FlorainN told former customers they were in the process of moving to a new name and domain for StarkRDP, where existing accounts and balances would be transferred.</p>
<p>&#8220;StarkRDP has always been operating by the law and is not involved in any of these alleged crimes and the legal process will confirm this,&#8221; the StarkRDP Telegram account wrote on January 30. &#8220;All of your servers are safe and they have not been collected in this operation. The only things that were seized is the website server and our domain. Unfortunately, no one can tell who took it and with whom we can talk about it. Therefore, we will restart operation soon, under a different name, to close the chapter [of] &#8216;StarkRDP.'&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=70323
title: Experts Flag Security, Privacy Risks in DeepSeek AI App
uri: Experts-Flag-Security-Privacy-Risks-in-DeepSeek-AI-App
url: https://krebsonsecurity.com/2025/02/experts-flag-security-privacy-risks-in-deepseek-ai-app/
content:
<p>New mobile apps from the Chinese artificial intelligence (AI) company <strong>DeepSeek</strong> have remained among the top three &#8220;free&#8221; downloads for Apple and Google devices since their debut on Jan. 25, 2025. But experts caution that many of DeepSeek&#8217;s design choices &#8212; such as using hard-coded encryption keys, and sending unencrypted user and device data to Chinese companies &#8212; introduce a number of glaring security and privacy risks.</p>
<p><img decoding="async" class="aligncenter wp-image-70327" src="media/4d6d41e2.deepseek.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek.png" alt="" width="747" height="417" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek.png 854w, https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-768x428.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-782x436.png 782w" sizes="(max-width: 747px) 100vw, 747px" /></p>
<p>Public interest in the DeepSeek AI chat apps swelled following widespread <a href="https://www.nytimes.com/2025/01/27/business/us-stock-market-deepseek-ai-sp500-nvidia.html" target="_blank" rel="noopener">media</a> reports that the upstart Chinese AI firm had managed to match the abilities of cutting-edge chatbots while using a fraction of the specialized computer chips that leading AI companies rely on. As of this writing, DeepSeek is the third most-downloaded &#8220;free&#8221; app on the Apple store, and #1 on Google Play.</p>
<p>DeepSeek&#8217;s rapid rise caught the attention of the mobile security firm <strong>NowSecure</strong>, a Chicago-based company that helps clients screen mobile apps for security and privacy threats. In <a href="https://www.nowsecure.com/blog/2025/02/06/nowsecure-uncovers-multiple-security-and-privacy-flaws-in-deepseek-ios-mobile-app/" target="_blank" rel="noopener">a teardown</a> of the DeepSeek app published today, NowSecure urged organizations to remove the DeepSeek iOS mobile app from their environments, citing security concerns.</p>
<p>NowSecure founder <strong>Andrew Hoog</strong> said they haven&#8217;t yet concluded an in-depth analysis of the DeepSeek app for <strong>Android</strong> devices, but that there is little reason to believe its basic design would be functionally much different.</p>
<p>Hoog told KrebsOnSecurity there were a number of qualities about the DeepSeek iOS app that suggest the presence of deep-seated security and privacy risks. For starters, he said, the app collects an awful lot of data about the user&#8217;s device.</p>
<p>&#8220;They are doing some very interesting things that are on the edge of advanced device fingerprinting,&#8221; Hoog said, noting that one property of the app tracks the device&#8217;s name &#8212; which for many iOS devices defaults to the customer&#8217;s name followed by the type of iOS device.</p>
<p>The device information shared, combined with the user&#8217;s Internet address and <a href="https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data/" target="_blank" rel="noopener">data gathered from mobile advertising companies</a>, could be used to deanonymize users of the DeepSeek iOS app, NowSecure warned. The report notes that DeepSeek communicates with <strong>Volcengine</strong>, a cloud platform developed by <strong>ByteDance</strong> (the makers of <strong>TikTok</strong>), although NowSecure said it wasn&#8217;t clear if the data is just leveraging ByteDance&#8217;s digital transformation cloud service or if the declared information share extends further between the two companies.</p>
<div id="attachment_70342" style="width: 760px" class="wp-caption aligncenter"><a href="media/294f9c92.deepseek-graphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-graphic.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70342" decoding="async" loading="lazy" class="wp-image-70342" src="media/294f9c92.deepseek-graphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-graphic.png" alt="" width="750" height="327" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-graphic.png 1634w, https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-graphic-768x335.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-graphic-1536x669.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/02/deepseek-graphic-782x341.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-70342" class="wp-caption-text">Image: NowSecure.</p></div>
<p>Perhaps more concerning, NowSecure said the iOS app transmits device information &#8220;in the clear,&#8221; without any encryption to encapsulate the data. This means the data being handled by the app could be intercepted, read, and even modified by anyone who has access to any of the networks that carry the app&#8217;s traffic.</p>
<p>&#8220;The DeepSeek iOS app globally disables App Transport Security (ATS) which is an iOS platform level protection that prevents sensitive data from being sent over unencrypted channels,&#8221; the report observed. &#8220;Since this protection is disabled, the app can (and does) send unencrypted data over the internet.&#8221;<span id="more-70323"></span></p>
<p>Hoog said the app does selectively encrypt portions of the responses coming from DeepSeek servers. But they also found it uses an insecure and now deprecated encryption algorithm called 3DES (aka <a href="https://en.wikipedia.org/wiki/Triple_DES" target="_blank" rel="noopener">Triple DES</a>), and that the developers had hard-coded the encryption key. That means the cryptographic key needed to decipher those data fields can be extracted from the app itself.</p>
<p>There were other, less alarming security and privacy issues highlighted in the report, but Hoog said he&#8217;s confident there are additional, unseen security concerns lurking within the app&#8217;s code.</p>
<p>&#8220;When we see people exhibit really simplistic coding errors, as you dig deeper there are usually a lot more issues,&#8221; Hoog said. &#8220;There is virtually no priority around security or privacy. Whether cultural, or mandated by China, or a witting choice, taken together they point to significant lapse in security and privacy controls, and that puts companies at risk.&#8221;</p>
<p>Apparently, plenty of others share this view. <em>Axios</em> <a href="https://www.axios.com/2025/01/30/house-congress-bans-deepseek-ai" target="_blank" rel="noopener">reported</a> on January 30 that U.S. congressional offices are being warned not to use the app.</p>
<p>&#8220;[T]hreat actors are already exploiting DeepSeek to deliver malicious software and infect devices,&#8221; read the notice from the chief administrative officer for the House of Representatives. &#8220;To mitigate these risks, the House has taken security measures to restrict DeepSeek’s functionality on all House-issued devices.&#8221;</p>
<p><em>TechCrunch</em> <a href="https://techcrunch.com/2025/02/03/deepseek-the-countries-and-agencies-that-have-banned-the-ai-companys-tech/" target="_blank" rel="noopener">reports</a> that Italy and Taiwan have already moved to ban DeepSeek over security concerns. <em>Bloomberg</em> <a href="https://www.bloomberg.com/news/articles/2025-01-30/pentagon-workers-used-deepseek-s-chatbot-for-days-before-block" target="_blank" rel="noopener">writes</a> that <strong>The Pentagon</strong> has blocked access to DeepSeek. <em>CNBC</em> <a href="https://www.cnbc.com/2025/01/31/nasa-becomes-latest-federal-agency-to-block-chinas-deepseek.html" target="_blank" rel="noopener">says</a> <strong>NASA</strong> also banned employees from using the service, as did the <strong>U.S. Navy</strong>.</p>
<p>Beyond security concerns tied to the DeepSeek iOS app, there are indications the Chinese AI company may be playing fast and loose with the data that it collects from and about users. On January 29, researchers at <strong>Wiz</strong> <a href="https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak" target="_blank" rel="noopener">said</a> they discovered a publicly accessible database linked to DeepSeek that exposed &#8220;a significant volume of chat history, backend data and sensitive information, including log streams, API secrets, and operational details.&#8221;</p>
<p>&#8220;More critically, the exposure allowed for full database control and potential privilege escalation within the DeepSeek environment, without any authentication or defense mechanism to the outside world,&#8221; Wiz wrote. [Full disclosure: Wiz is currently an advertiser on this website.]</p>
<p>KrebsOnSecurity sought comment on the report from DeepSeek and from Apple. This story will be updated with any substantive replies.</p>


feed_id: https://krebsonsecurity.com/?p=70358
title: Teen on Musk’s DOGE Team Graduated from ‘The Com’
uri: Teen-on-Musk-s-DOGE-Team-Graduated-from-The-Com
url: https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/
content:
<p><em>Wired</em> reported this week that a 19-year-old working for <strong>Elon Musk</strong>&#8216;s so-called <strong>Department of Government Efficiency</strong> (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so. As today&#8217;s story explores, the DOGE teen is a former denizen of &#8216;<strong>The Com</strong>,&#8217; an archipelago of Discord and Telegram chat channels that function as a kind of distributed cybercriminal social network for facilitating instant collaboration.</p>
<p>Since President Trump&#8217;s second inauguration, Musk&#8217;s DOGE team has gained access to a truly staggering amount of personal and sensitive data on American citizens, moving quickly to seize control over databases at the <strong>U.S. Treasury</strong>, the <strong>Office of Personnel Management</strong>, the <strong>Department of Education</strong>, and the <strong>Department of Health and Human Resources</strong>, among others.</p>
<p><em>Wired</em> first <a href="https://archive.ph/HCCA4" target="_blank" rel="noopener">reported on Feb. 2</a> that one of the technologists on Musk&#8217;s crew is a 19-year-old high school graduate named <strong>Edward Coristine</strong>, who reportedly goes by the nickname &#8220;Big Balls&#8221; online. One of the companies Coristine founded, <strong>Tesla.Sexy LLC</strong>, was set up in 2021, when he would have been around 16 years old.</p>
<p>&#8220;Tesla.Sexy LLC controls dozens of web domains, including at least two Russian-registered domains,&#8221; <em>Wired</em> reported. &#8220;One of those domains, which is still active, offers a service called Helfie, which is an AI bot for Discord servers targeting the Russian market. While the operation of a Russian website would not violate US sanctions preventing Americans doing business with Russian companies, it could potentially be a factor in a security clearance review.&#8221;</p>
<p>Mr. Coristine has not responded to requests for comment. In <a href="https://archive.ph/VAD48" target="_blank" rel="noopener">a follow-up story</a> this week, <em>Wired</em> found that someone using a Telegram handle tied to Coristine solicited a DDoS-for-hire service in 2022, and that he worked for a short time at a company that specializes in protecting customers from DDoS attacks.</p>
<div id="attachment_70369" style="width: 647px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70369" decoding="async" class="size-full wp-image-70369" src="media/9293e3c7.coristine.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/coristine.png" alt="" width="637" height="636" /><p id="caption-attachment-70369" class="wp-caption-text">A profile photo from Coristine&#8217;s WhatsApp account.</p></div>
<p>Internet routing records <a href="https://bgp.he.net/net/23.133.104.0/24#_whois" target="_blank" rel="noopener">show</a> that Coristine runs an Internet service provider called <strong>Packetware</strong> (AS400495). Also known as &#8220;<strong>DiamondCDN</strong>,&#8221; Packetware <a href="https://bgp.he.net/net/23.133.104.0/24#_dnsrecords" target="_blank" rel="noopener">currently hosts</a> tesla[.]sexy and diamondcdn[.]com, among other domains.</p>
<p>DiamondCDN was advertised and claimed by someone who used the nickname &#8220;<strong>Rivage</strong>&#8221; on several Com-based Discord channels over the years. A review of chat logs from some of those channels show other members frequently referred to Rivage as &#8220;Edward.&#8221;</p>
<p>From late 2020 to late 2024, Rivage&#8217;s conversations would show up in multiple Com chat servers that are closely monitored by security companies. In November 2022, Rivage could be seen requesting recommendations for a reliable and powerful DDoS-for-hire service.</p>
<p>Rivage made that request in the cybercrime channel &#8220;<strong>Dstat</strong>,&#8221; a core Com hub where users could buy and sell attack services. <a href="https://www.bleepingcomputer.com/news/security/ddos-site-dstatcc-seized-and-two-suspects-arrested-in-germany/" target="_blank" rel="noopener">Dstat’s website dstat[.]cc was seized</a> in 2024 as part of “Operation PowerOFF,” an international law enforcement action against DDoS services.</p>
<p>Coristine&#8217;s LinkedIn profile said that in 2022 he worked at an anti-DDoS company called <strong>Path Networks</strong>, which <em>Wired</em> generously described as a &#8220;network monitoring firm known for hiring reformed blackhat hackers.&#8221; <em>Wired</em> wrote:</p>
<p>&#8220;At Path Network, Coristine worked as a systems engineer from April to June of 2022, according to his now-deleted LinkedIn résumé. Path has at times listed as employees <strong>Eric Taylor</strong>, also known as Cosmo the God, a well-known former cybercriminal and member of the hacker group UGNazis, as well as Matthew Flannery, an Australian convicted hacker whom police allege was a member of the hacker group LulzSec. It’s unclear whether Coristine worked at Path concurrently with those hackers, and WIRED found no evidence that either Coristine or other Path employees engaged in illegal activity while at the company.&#8221;</p>
<p>The founder of Path is a young man named <strong>Marshal Webb</strong>. I wrote about Webb back in 2016, in a story about a DDoS defense company he co-founded called <strong>BackConnect Security LLC</strong>. On September 20, 2016, KrebsOnSecurity published data showing that the company <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank" rel="noopener">had a history of hijacking Internet address space that belonged to others</a>.</p>
<p>Less than 24 hours after that story ran, KrebsOnSecurity.com was <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">hit with the biggest DDoS attack the Internet had ever seen at the time</a>. That sustained attack <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">kept this site offline for nearly 4 days</a>.</p>
<p>The other founder of BackConnect Security LLC was <strong>Tucker Preston</strong>, a Georgia man who <a href="https://krebsonsecurity.com/2020/01/ddos-mitigation-firm-founder-admits-to-ddos/" target="_blank" rel="noopener">pleaded guilty in 2020</a> to paying a DDoS-for-hire service to launch attacks against others.</p>
<p>The aforementioned Path employee Eric Taylor <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank" rel="noopener">pleaded guilty in 2017</a> to charges including <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">an attack on our home in 2013</a>. Taylor was among several men involved in making a false report to my local police department about a supposed hostage situation at our residence in Virginia. In response, a heavily-armed police force surrounded my home and put me in handcuffs at gunpoint before the police realized it was all a dangerous hoax known as &#8220;swatting.&#8221;</p>
<p>CosmoTheGod rocketed to Internet infamy in 2013 when he and a number of other hackers <a href="https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank" rel="noopener">set up the Web site exposed[dot]su</a>, which “doxed” dozens of public officials and celebrities by publishing the address, Social Security numbers and other personal information on the former First Lady Michelle Obama, the then-director of the FBI and the U.S. attorney general, among others. The group also swatted many of the people they doxed.</p>
<p><em>Wired</em> noted that Coristine only worked at Path for a few months in 2022, but the story didn&#8217;t mention why his tenure was so short. A screenshot shared on the website <a href="https://www.pathtruths.com" target="_blank" rel="noopener">pathtruths.com</a> includes a snippet of conversations in June 2022 between Path employees discussing Coristine&#8217;s firing.</p>
<p>According to that record, Path founder Marshal Webb dismissed Coristine for leaking internal documents to a competitor. Not long after Coristine&#8217;s termination, someone leaked an abundance of internal Path documents and conversations. Among other things, those chats revealed that one of Path&#8217;s technicians was a Canadian man named <strong>Curtis Gervais</strong> who was convicted in 2017 of <a href="https://krebsonsecurity.com/2017/09/canadian-man-gets-9-months-detention-for-serial-swattings-bomb-threats/" target="_blank" rel="noopener">perpetrating dozens of swatting attacks and fake bomb threats</a> &#8212; including at least two attempts against our home in 2014.</p>
<div id="attachment_70370" style="width: 595px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70370" decoding="async" loading="lazy" class="size-full wp-image-70370" src="media/ef343b91.pathchat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/pathchat.png" alt="" width="585" height="808" /><p id="caption-attachment-70370" class="wp-caption-text">A snippet of text from an internal Path chat room, wherein members discuss the reason for Coristine&#8217;s termination: Allegedly, leaking internal company information. Source: Pathtruths.com.</p></div>
<p><span id="more-70358"></span></p>
<p>On May 11, 2024, Rivage posted on a Discord channel for a DDoS protection service that is chiefly marketed to members of The Com. Rivage expressed frustration with his time spent on Com-based communities, suggesting that its profitability had been oversold.</p>
<p>&#8220;I don&#8217;t think there&#8217;s a lot of money to be made in the com,&#8221; Rivage lamented. &#8220;I&#8217;m not buying Heztner [servers] to set up some com VPN.&#8221;</p>
<p>Rivage largely stopped posting messages on Com channels after that. <em>Wired</em> reports that Coristine subsequently spent three months last summer working at <strong>Neuralink</strong>, Elon Musk&#8217;s brain implant startup.</p>
<p>The trouble with all this is that even if someone sincerely intends to exit The Com after years of consorting with cybercriminals, they are often still subject to personal attacks, harassment and hacking long after they have left the scene.</p>
<p>That&#8217;s because a huge part of Com culture involves harassing, swatting and hacking other members of the community. These internecine attacks are often for financial gain, but just as frequently they are perpetrated by cybercrime groups to exact retribution from or assert dominance over rival gangs.</p>
<p>Experts say it is extremely difficult for former members of violent street gangs to gain a security clearance needed to view sensitive or classified information held by the U.S. government. That&#8217;s because ex-gang members are highly susceptible to extortion and coercion from current members of the same gang, and that alone presents an unacceptable security risk for intelligence agencies.</p>
<p>And make no mistake: The Com is the English-language cybercriminal hacking equivalent of a violent street gang. KrebsOnSecurity has published numerous stories detailing how feuds within the community <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">periodically spill over into real-world violence</a>.</p>
<p>When Coristine&#8217;s name surfaced in <em>Wired</em>&#8216;s report this week, members of The Com immediately took notice. In the following segment from a February 5, 2025 chat in a Com-affiliated hosting provider, members criticized Rivage&#8217;s skills, and discussed harassing his family and notifying authorities about incriminating accusations that may or may not be true.</p>
<blockquote><p>2025-02-05 16:29:44 UTC vperked#0 they got this nigga on indiatimes man<br />
2025-02-05 16:29:46 UTC alexaloo#0 Their cropping is worse than AI could have done<br />
2025-02-05 16:29:48 UTC hebeatsme#0 bro who is that<br />
2025-02-05 16:29:53 UTC hebeatsme#0 yalla re talking about<br />
2025-02-05 16:29:56 UTC xewdy#0 edward<br />
2025-02-05 16:29:56 UTC .yarrb#0 rivagew<br />
2025-02-05 16:29:57 UTC vperked#0 Rivarge<br />
2025-02-05 16:29:57 UTC xewdy#0 diamondcdm<br />
2025-02-05 16:29:59 UTC vperked#0 i cant spell it<br />
2025-02-05 16:30:00 UTC hebeatsme#0 rivage<br />
2025-02-05 16:30:08 UTC .yarrb#0 yes<br />
2025-02-05 16:30:14 UTC hebeatsme#0 i have him added<br />
2025-02-05 16:30:20 UTC hebeatsme#0 hes on discord still<br />
2025-02-05 16:30:47 UTC .yarrb#0 hes focused on stroking zaddy elon<br />
2025-02-05 16:30:47 UTC vperked#0 https://en.wikipedia.org/wiki/Edward_Coristine<br />
2025-02-05 16:30:50 UTC vperked#0 no fucking way<br />
2025-02-05 16:30:53 UTC vperked#0 they even made a wiki for him<br />
2025-02-05 16:30:55 UTC vperked#0 LOOOL<br />
2025-02-05 16:31:05 UTC hebeatsme#0 no way<br />
2025-02-05 16:31:08 UTC hebeatsme#0 hes not a good dev either<br />
2025-02-05 16:31:14 UTC hebeatsme#0 like????<br />
2025-02-05 16:31:22 UTC hebeatsme#0 has to be fake<br />
2025-02-05 16:31:24 UTC xewdy#0 and theyre saying ts<br />
2025-02-05 16:31:29 UTC xewdy#0 like ok bro<br />
2025-02-05 16:31:51 UTC .yarrb#0 now i wanna know what all the other devs are like&#8230;<br />
2025-02-05 16:32:00 UTC vperked#0 &#8220;`Coristine used the moniker &#8220;bigballs&#8221; on LinkedIn and @Edwardbigballer on Twitter, according to The Daily Dot.[&#8220;`<br />
2025-02-05 16:32:05 UTC vperked#0 LOL<br />
2025-02-05 16:32:06 UTC hebeatsme#0 lmfaooo<br />
2025-02-05 16:32:07 UTC vperked#0 bro<br />
2025-02-05 16:32:10 UTC hebeatsme#0 bro<br />
2025-02-05 16:32:17 UTC hebeatsme#0 has to be fake right<br />
2025-02-05 16:32:22 UTC .yarrb#0 does it mention Rivage?<br />
2025-02-05 16:32:23 UTC xewdy#0 He previously worked for NeuraLink, a brain computer interface company led by Elon Musk<br />
2025-02-05 16:32:26 UTC xewdy#0 bro what<br />
2025-02-05 16:32:27 UTC alexaloo#0 I think your current occupation gives you a good insight of what probably goes on<br />
2025-02-05 16:32:29 UTC hebeatsme#0 bullshit man<br />
2025-02-05 16:32:33 UTC xewdy#0 this nigga got hella secrets<br />
2025-02-05 16:32:37 UTC hebeatsme#0 rivage couldnt print hello world<br />
2025-02-05 16:32:42 UTC hebeatsme#0 if his life was on the line<br />
2025-02-05 16:32:50 UTC xewdy#0 nigga worked for neuralink<br />
2025-02-05 16:32:54 UTC hebeatsme#0 bullshit<br />
2025-02-05 16:33:06 UTC Nashville Dispatch ##0000 ||@PD Ping||<br />
2025-02-05 16:33:07 UTC hebeatsme#0 must have killed all those test pigs with some bugs<br />
2025-02-05 16:33:24 UTC hebeatsme#0 ur telling me the rivage who failed to start a company<br />
2025-02-05 16:33:28 UTC hebeatsme#0 https://cdn.camp<br />
2025-02-05 16:33:32 UTC hebeatsme#0 who didnt pay for servers<br />
2025-02-05 16:33:34 UTC hebeatsme#0 ?<br />
2025-02-05 16:33:42 UTC hebeatsme#0 was too cheap<br />
2025-02-05 16:33:44 UTC vperked#0 yes<br />
2025-02-05 16:33:50 UTC hebeatsme#0 like??<br />
2025-02-05 16:33:53 UTC hebeatsme#0 it aint adding up<br />
2025-02-05 16:33:56 UTC alexaloo#0 He just needed to find his calling idiot.<br />
2025-02-05 16:33:58 UTC alexaloo#0 He found it.<br />
2025-02-05 16:33:59 UTC hebeatsme#0 bro<br />
2025-02-05 16:34:01 UTC alexaloo#0 Cope in a river dude<br />
2025-02-05 16:34:04 UTC hebeatsme#0 he cant make good money right<br />
2025-02-05 16:34:08 UTC hebeatsme#0 doge is about efficiency<br />
2025-02-05 16:34:11 UTC hebeatsme#0 he should make $1/he<br />
2025-02-05 16:34:15 UTC hebeatsme#0 $1/hr<br />
2025-02-05 16:34:25 UTC hebeatsme#0 and be whipped for better code<br />
2025-02-05 16:34:26 UTC vperked#0 prolly makes more than us<br />
2025-02-05 16:34:35 UTC vperked#0 with his dad too<br />
2025-02-05 16:34:52 UTC hebeatsme#0 time to report him for fraud<br />
2025-02-05 16:34:54 UTC hebeatsme#0 to donald trump<br />
2025-02-05 16:35:04 UTC hebeatsme#0 rivage participated in sim swap hacks in 2018<br />
2025-02-05 16:35:08 UTC hebeatsme#0 put that on his wiki<br />
2025-02-05 16:35:10 UTC hebeatsme#0 thanks<br />
2025-02-05 16:35:15 UTC hebeatsme#0 and in 2021<br />
2025-02-05 16:35:17 UTC hebeatsme#0 thanks<br />
2025-02-05 16:35:19 UTC chainofcommand#0 i dont think they&#8217;ll care tbh</p></blockquote>
<p>Given the speed with which Musk&#8217;s DOGE team was allowed access to such critical government databases, it strains credulity that Coristine could have been properly cleared beforehand. After all, he&#8217;d recently been dismissed from a job <em>for allegedly leaking internal company information to outsiders</em>.</p>
<p>According to the national security adjudication <a href="media/9d341e57.SEAD-4-Adjudicative-Guidelines-U.pdf" data-original-source="https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf" target="_blank" rel="noopener">guidelines</a> (PDF) released by the <strong>Director of National Intelligence</strong> (DNI), eligibility determinations take into account a person&#8217;s stability, trustworthiness, reliability, discretion, character, honesty, judgement, and ability to protect classified information.</p>
<p>The DNI policy further states that &#8220;eligibility for covered individuals shall be granted only when facts and circumstances indicate that eligibility is clearly consistent with the national security interests of the United States, and any doubt shall be resolved in favor of national security.&#8221;</p>
<p>On Thursday, 25-year-old DOGE staff member <strong>Marko Elez</strong> resigned after being linked to a deleted social media account that advocated racism and eugenics. Elez resigned after <em>The Wall Street Journal</em> <a href="https://www.wsj.com/tech/doge-staffer-resigns-over-racist-posts-d9f11a93" target="_blank" rel="noopener">asked</a> the White House about his connection to the account.</p>
<p>&#8220;Just for the record, I was racist before it was cool,” the account posted in July. &#8220;You could not pay me to marry outside of my ethnicity,” the account wrote on X in September. &#8220;Normalize Indian hate,&#8221; the account wrote the same month, in reference to a post noting the prevalence of people from India in Silicon Valley.</p>
<p>Elez&#8217;s resignation came a day after the Department of Justice agreed to limit the number of DOGE employees who have access to federal payment systems. The DOJ said access would be limited to two people, Elez and <strong>Tom Krause</strong>, the CEO of a company called Cloud Software Group.</p>
<p>Earlier today, Musk <a href="https://thehill.com/business/5133430-elon-musk-doge-staffer-racist-posts/" target="_blank" rel="noopener">said he planned to rehire Elez</a> after <strong>President Trump</strong> and <strong>Vice President JD Vance</strong> reportedly endorsed the idea. Speaking at The White House today, Trump said he wasn&#8217;t concerned about the security of personal information and other data accessed by DOGE, adding that he was &#8220;very proud of the job that this group of young people&#8221; are doing.</p>
<p>A White House official <a href="https://www.reuters.com/world/us/staffer-with-elon-musks-doge-amplified-white-supremacists-online-2025-02-07/" target="_blank" rel="noopener">told</a> <em>Reuters</em> on Wednesday that Musk and his engineers have appropriate security clearances and are operating in &#8220;full compliance with federal law, appropriate security clearances, and as employees of the relevant agencies, not as outside advisors or entities.&#8221;</p>
<p><em>NPR</em> <a href="https://www.npr.org/2025/02/07/nx-s1-5288988/doge-elon-musk-staff-trump" target="_blank" rel="noopener">reports</a> Trump added that his administration&#8217;s cost-cutting efforts would soon turn to the Education Department and the Pentagon, &#8220;where he suggested without evidence that there could be &#8216;trillions&#8217; of dollars in wasted spending within the $6.75 trillion the federal government spent in fiscal year 2024.&#8221;</p>
<p>GOP leaders in the Republican-controlled House and Senate have largely shrugged about Musk&#8217;s ongoing efforts to seize control over federal databases, dismantle agencies mandated by Congress, freeze federal spending on a range of already-appropriated government programs, and threaten workers with layoffs.</p>
<p>Meanwhile, multiple parties have sued to stop DOGE&#8217;s activities. ABC News <a href="https://abcnews.go.com/US/judge-decide-block-doge-accessing-sensitive-labor-department/story?id=118575362" target="_blank" rel="noopener">says</a> a federal judge was to rule today on whether DOGE should be blocked from accessing Department of Labor records, following a lawsuit alleging Musk&#8217;s team sought to illegally access highly sensitive data, including medical information, from the federal government.</p>
<p>At least 13 state attorney general say they plan to file a lawsuit to stop DOGE from accessing federal payment systems containing Americans&#8217; sensitive personal information, <a href="https://www.mychamplainvalley.com/news/local-news/vermont-joins-lawsuit-over-doge-access-to-government-payment-system/" target="_blank" rel="noopener">reports</a> <em>The Associated Press</em>.</p>
<p>Reuters <a href="https://www.reuters.com/world/us/us-treasury-temporarily-agrees-limit-doge-access-amid-privacy-lawsuit-2025-02-06/" target="_blank" rel="noopener">reported Thursday</a> that the U.S. Treasury Department had agreed not to give Musk&#8217;s team access to its payment systems while a judge is hearing arguments in a lawsuit by employee unions and retirees alleging Musk illegally searched those records.</p>
<p><em>Ars Technica</em> <a href="https://arstechnica.com/tech-policy/2025/02/lawsuit-tries-to-block-doges-access-to-student-loan-data/" target="_blank" rel="noopener">writes</a> that The Department of Education (DoE) was sued Friday by a California student association demanding an &#8220;immediate stop&#8221; to DOGE&#8217;s &#8220;unlawfully&#8221; digging through student loan data to potentially dismantle the DoE.</p>


feed_id: https://krebsonsecurity.com/?p=70396
title: Microsoft Patch Tuesday, February 2025 Edition
uri: Microsoft-Patch-Tuesday-February-2025-Edition
url: https://krebsonsecurity.com/2025/02/microsoft-patch-tuesday-february-2025-edition/
content:
<p><strong>Microsoft</strong> today issued security updates to fix at least 56 vulnerabilities in its Windows operating systems and supported software, including two zero-day flaws that are being actively exploited.</p>
<p><img decoding="async" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>All supported Windows operating systems will receive an update this month for a buffer overflow vulnerability that carries the catchy name <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418" target="_blank" rel="noopener">CVE-2025-21418</a>. This patch should be a priority for enterprises, as Microsoft says it is being exploited, has low attack complexity, and no requirements for user interaction.</p>
<p><strong>Tenable</strong> senior staff research engineer <strong>Satnam Narang</strong> noted that since 2022, there have been nine elevation of privilege vulnerabilities in this same Windows component &#8212; three each year &#8212; including one in 2024 that was exploited in the wild as a zero day (CVE-2024-38193).</p>
<p>&#8220;CVE-2024-38193 was exploited by the North Korean APT group known as Lazarus Group to implant a new version of the FudModule rootkit in order to maintain persistence and stealth on compromised systems,&#8221; Narang said. &#8220;At this time, it is unclear if CVE-2025-21418 was also exploited by Lazarus Group.&#8221;</p>
<p>The other zero-day, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391" target="_blank" rel="noopener">CVE-2025-21391</a>, is an elevation of privilege vulnerability in Windows Storage that could be used to delete files on a targeted system. Microsoft&#8217;s advisory on this bug references something called “CWE-59: Improper Link Resolution Before File Access,&#8221; says no user interaction is required, and that the attack complexity is low.</p>
<p><strong>Adam Barnett</strong>, lead software engineer at <strong>Rapid7</strong>, said although the advisory provides scant detail, and even offers some vague reassurance that &#8216;an attacker would only be able to delete targeted files on a system,&#8217; it would be a mistake to assume that the impact of deleting arbitrary files would be limited to data loss or denial of service.</p>
<p>&#8220;As long ago as 2022, ZDI researchers set out how a motivated attacker could parlay arbitrary file deletion into full SYSTEM access using techniques which also involve creative misuse of symbolic links,&#8221;Barnett wrote.<span id="more-70396"></span></p>
<p>One vulnerability patched today that was publicly disclosed earlier is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21377" target="_blank" rel="noopener">CVE-2025-21377</a>, another weakness that could allow an attacker to elevate their privileges on a vulnerable Windows system. Specifically, this is yet another Windows flaw that can be used to steal NTLMv2 hashes &#8212; essentially allowing an attacker to authenticate as the targeted user without having to log in.</p>
<p>According to Microsoft, minimal user interaction with a malicious file is needed to exploit CVE-2025-21377, including selecting, inspecting or &#8220;performing an action other than opening or executing the file.&#8221;</p>
<p>&#8220;This trademark linguistic ducking and weaving may be Microsoft’s way of saying &#8216;if we told you any more, we’d give the game away,'&#8221; Barnett said. &#8220;Accordingly, Microsoft assesses exploitation as more likely.&#8221;</p>
<p>The <a href="https://isc.sans.edu/diary/Microsoft%20February%202025%20Patch%20Tuesday/31674" target="_blank" rel="noopener">SANS Internet Storm Center</a> has a handy list of all the Microsoft patches released today, indexed by severity. Windows enterprise administrators would do well to keep an eye on <a href="http://www.askwoody.com" target="_blank" rel="noopener">askwoody.com</a>, which often has the scoop on any patches causing problems.</p>
<p>It&#8217;s getting harder to buy Windows software that isn&#8217;t also bundled with Microsoft&#8217;s flagship Copilot artificial intelligence (AI) feature. Last month Microsoft started bundling Copilot with <strong>Microsoft Office 365</strong>, which Redmond has since rebranded as &#8220;<strong>Microsoft 365 Copilot</strong>.&#8221; Ostensibly to offset the costs of its substantial AI investments, Microsoft also jacked up prices from 22 percent to 30 percent for upcoming license renewals and new subscribers.</p>
<p>Office-watch.com <a href="https://office-watch.com/2025/microsoft-365-classic/" target="_blank" rel="noopener">writes</a> that existing Office 365 users who are paying an annual cloud license do have the option of &#8220;Microsoft 365 Classic,&#8221; an AI-free subscription at a lower price, but that many customers are not offered the option until they attempt to cancel their existing Office subscription.</p>
<p>In other security patch news, <strong>Apple</strong> has shipped iOS 18.3.1, which fixes a <a href="https://support.apple.com/en-us/122174">zero day</a> vulnerability (CVE-2025-24200) that is showing up in attacks.</p>
<p><strong>Adobe</strong> has issued security updates that fix a total of 45 vulnerabilities across <strong>InDesign</strong>, <strong>Commerce</strong>, <strong>Substance 3D</strong> <strong>Stager</strong>, <strong>InCopy</strong>, <strong>Illustrator</strong>, <strong>Substance 3D Designer</strong> and <strong>Photoshop Elements</strong>.</p>
<p><strong>Chris Goettl</strong> at <strong>Ivanti</strong> notes that <strong>Google Chrome</strong> is shipping an update today which will trigger updates for Chromium based browsers including <strong>Microsoft Edge</strong>, so be on the lookout for Chrome and Edge updates as we proceed through the week.</p>


feed_id: https://krebsonsecurity.com/?p=70392
title: Nearly a Year Later, Mozilla is Still Promoting OneRep
uri: Nearly-a-Year-Later-Mozilla-is-Still-Promoting-OneRep
url: https://krebsonsecurity.com/2025/02/nearly-a-year-later-mozilla-is-still-promoting-onerep/
content:
<p>In mid-March 2024, KrebsOnSecurity revealed that the founder of the personal data removal service <strong>Onerep</strong> also founded dozens of people-search companies. Shortly after that investigation was published, <strong>Mozilla</strong> said it would stop bundling Onerep with the <strong>Firefox</strong> browser and wind down its partnership with the company. But nearly a year later, Mozilla is still promoting it to Firefox users.</p>
<p>Mozilla offers Onerep to Firefox users on a subscription basis as part of <a href="https://www.mozilla.org/en-US/about/legal/terms/subscription-services/" target="_blank" rel="noopener">Mozilla Monitor Plus</a>. Launched in 2018 under the name <a href="https://en.wikipedia.org/wiki/Firefox_Monitor" target="_blank" rel="noopener">Firefox Monitor</a>, Mozilla Monitor also checks data from the website <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">Have I Been Pwned?</a> to let users know when their email addresses or password are leaked in data breaches.</p>
<p>The ink on that partnership agreement had barely dried before KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">published a story</a> showing that Onerep’s Belarusian CEO and founder <strong>Dimitiri Shelest</strong> launched dozens of people-search services since 2010, including a still-active data broker called <strong>Nuwber</strong> that sells background reports on people. This seemed to contradict Onerep&#8217;s stated motto, &#8220;We believe that no one should compromise personal online security and get a profit from it.”</p>
<p>Shelest released <a href="media/6f106324.Dimitri-Shelest-Letter-_-Comment-on-Krebs-article-3.20.24-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/Dimitri-Shelest-Letter-_-Comment-on-Krebs-article-3.20.24-1.pdf" target="_blank" rel="noopener">a lengthy statement</a> (PDF) wherein he acknowledged maintaining an ownership stake in <strong>Nuwber</strong>, a consumer data broker he founded in 2015 — around the same time he started Onerep.</p>
<div id="attachment_66783" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66783" decoding="async" class=" wp-image-66783" src="media/4cc78458.onerep-shellest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png" alt="" width="750" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png 1275w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-768x450.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-782x458.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66783" class="wp-caption-text">Onerep.com CEO and founder Dimitri Shelest, as pictured on the &#8220;about&#8221; page of onerep.com.</p></div>
<p>Shelest maintained that Nuwber has “zero cross-over or information-sharing with Onerep,” and said any other old domains that may be found and associated with his name are no longer being operated by him.</p>
<p>“I get it,” Shelest wrote. “My affiliation with a people search business may look odd from the outside. In truth, if I hadn’t taken that initial path with a deep dive into how people search sites work, Onerep wouldn’t have the best tech and team in the space. Still, I now appreciate that we did not make this more clear in the past and I’m aiming to do better in the future.”</p>
<p>When asked to comment on the findings, Mozilla said then that although customer data was never at risk, the outside financial interests and activities of Onerep&#8217;s CEO did not align with their values.</p>
<p>&#8220;We&#8217;re working now to solidify a transition plan that will provide customers with a seamless experience and will continue to put their interests first,&#8221; Mozilla <a href="https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-after-ceo-admits-to-running-people-search-networks/" target="_blank" rel="noopener">said</a>.</p>
<p>In October 2024, Mozilla published a statement saying the search for a different provider was taking longer than anticipated.</p>
<p>&#8220;While we continue to evaluate vendors, finding a technically excellent and values-aligned partner takes time,&#8221; Mozilla <a href="https://support.mozilla.org/en-US/kb/securing-new-partner-monitor-plus" target="_blank" rel="noopener">wrote</a>. &#8220;While we continue this search, Onerep will remain the backend provider, ensuring that we can maintain uninterrupted services while we continue evaluating new potential partners that align more closely with Mozilla’s values and user expectations. We are conducting thorough diligence to find the right vendor.&#8221;</p>
<p>Asked for an update, Mozilla said the search for a replacement partner continues.</p>
<p>&#8220;The work’s ongoing but we haven’t found the right alternative yet,&#8221; Mozilla said in an emailed statement. &#8220;Our customers’ data remains safe, and since the product provides a lot of value to our subscribers, we’ll continue to offer it during this process.”</p>
<p>It&#8217;s a win-win for Mozilla that they&#8217;ve received accolades for their principled response while continuing to partner with Onerep almost a year later. But if it takes so long to find a suitable replacement, what does that say about the personal data removal industry itself?<span id="more-70392"></span></p>
<p>Onerep appears to be working in partnership with another problematic people-search service: <strong>Radaris</strong>, which has a history of ignoring opt-out requests or failing to honor them. A week before breaking the story about Onerep, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">published research</a> showing the co-founders of Radaris were two native Russian brothers who&#8217;d built a vast network of affiliate marketing programs and consumer data broker services.</p>
<p>Lawyers for the Radaris co-founders threatened to sue KrebsOnSecurity unless that story was retracted in full, claiming the founders were in fact Ukrainian and that our reporting had defamed the brothers by associating them with the actions of Radaris. Instead, we published <a href="https://krebsonsecurity.com/2024/06/krebsonsecurity-threatened-with-defamation-lawsuit-over-fake-radaris-ceo/" target="_blank" rel="noopener">a follow-up investigation</a> which showed that not only did the brothers from Russia create Radaris, for many years they issued press releases quoting a fictitious CEO seeking money from investors.</p>
<p>Several readers have shared emails they received from Radaris after attempting to remove their personal data, and those messages show Radaris has been promoting Onerep.</p>
<div id="attachment_70413" style="width: 760px" class="wp-caption aligncenter"><a href="media/92e812d6.onerep-radaris-email.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/onerep-radaris-email.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70413" decoding="async" loading="lazy" class="wp-image-70413" src="media/92e812d6.onerep-radaris-email.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/onerep-radaris-email.png" alt="" width="750" height="316" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/onerep-radaris-email.png 1402w, https://krebsonsecurity.com/wp-content/uploads/2025/02/onerep-radaris-email-768x324.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/onerep-radaris-email-782x330.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-70413" class="wp-caption-text">An email from Radaris promoting Onerep.</p></div>


feed_id: https://krebsonsecurity.com/?p=70276
title: How Phished Data Turns into Apple & Google Wallets
uri: How-Phished-Data-Turns-into-Apple-Google-Wallets
url: https://krebsonsecurity.com/2025/02/how-phished-data-turns-into-apple-google-wallets/
content:
<p>Carding &#8212; the underground business of stealing, selling and swiping stolen payment card data &#8212; has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovation from cybercrime groups in China is breathing new life into the carding industry, by turning phished card data into mobile wallets that can be used online and at main street stores.</p>
<div id="attachment_70443" style="width: 490px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70443" decoding="async" class="size-full wp-image-70443" src="media/3f272139.tollpassphishing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/tollpassphishing.png" alt="" width="480" height="630" /><p id="caption-attachment-70443" class="wp-caption-text">An image from one Chinese phishing group&#8217;s Telegram channel shows various toll road phish kits available.</p></div>
<p>If you own a mobile phone, the chances are excellent that at some point in the past two years it has received at least one phishing message that spoofs the <strong>U.S. Postal Service</strong> to supposedly collect some outstanding delivery fee, or an SMS that pretends to be a local toll road operator warning of a delinquent toll fee.</p>
<p>These messages are being sent through sophisticated phishing kits sold by several cybercriminals based in mainland China. And they are not traditional SMS phishing or &#8220;<strong>smishing</strong>&#8221; messages, as they bypass the mobile networks entirely. Rather, the missives are sent through the <strong>Apple iMessage</strong> service and through <a href="https://en.wikipedia.org/wiki/Rich_Communication_Services" target="_blank" rel="noopener">RCS</a>, the functionally equivalent technology on <strong>Google</strong> phones.</p>
<p>People who enter their payment card data at one of these sites will be told their financial institution needs to verify the small transaction by sending a one-time passcode to the customer&#8217;s mobile device. In reality, that code will be sent by the victim&#8217;s financial institution to verify that the user indeed wishes to link their card information to a mobile wallet.</p>
<p>If the victim then provides that one-time code, the phishers will link the card data to a new mobile wallet from Apple or Google, loading the wallet onto a mobile phone that the scammers control.</p>
<h2>CARDING REINVENTED</h2>
<p><strong>Ford Merrill</strong> works in security research at <a href="https://www.secalliance.com/" target="_blank" rel="noopener">SecAlliance</a>, a <a href="https://www.csis.com/" target="_blank" rel="noopener">CSIS Security Group</a> company. Merrill has been studying the evolution of several China-based smishing gangs, and found that most of them feature helpful and informative video tutorials in their sales accounts on Telegram. Those videos show the thieves are loading multiple stolen digital wallets on a single mobile device, and then selling those phones in bulk for hundreds of dollars apiece.</p>
<p>&#8220;Who says carding is dead?,&#8221; said Merrill, who presented about his findings at the <a href="https://www.m3aawg.org/upcoming-meetings" target="_blank" rel="noopener">M3AAWG</a> security conference in Lisbon earlier today. &#8220;This is the best mag stripe cloning device ever. This threat actor is saying you need to buy at least 10 phones, and they&#8217;ll air ship them to you.&#8221;</p>
<p>One promotional video shows stacks of milk crates stuffed full of phones for sale. A closer inspection reveals that each phone is affixed with a handwritten notation that typically references the date its mobile wallets were added, the number of wallets on the device, and the initials of the seller.</p>
<div id="attachment_70436" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70436" decoding="async" loading="lazy" class=" wp-image-70436" src="media/4b420841.phishingphones.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones.png" alt="" width="749" height="567" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones.png 1160w, https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones-768x581.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones-782x591.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70436" class="wp-caption-text">An image from the Telegram channel for a popular Chinese smishing kit vendor shows 10 mobile phones for sale, each loaded with 4-6 digital wallets from different UK financial institutions.</p></div>
<p>Merrill said one common way criminal groups in China are cashing out with these stolen mobile wallets involves setting up fake e-commerce businesses on <strong>Stripe</strong> or <strong>Zelle</strong> and running transactions through those entities &#8212; often for amounts totaling between $100 and $500.</p>
<p>Merrill said that when these phishing groups first began operating in earnest two years ago, they would wait between 60 to 90 days before selling the phones or using them for fraud. But these days that waiting period is more like just seven to ten days, he said.</p>
<p>&#8220;When they first installed this, the actors were very patient,&#8221; he said. &#8220;Nowadays, they only wait like 10 days before [the wallets] are hit hard and fast.&#8221;<span id="more-70276"></span></p>
<h2>GHOST TAP</h2>
<p>Criminals also can cash out mobile wallets by obtaining real point-of-sale terminals and using tap-to-pay on phone after phone. But they also offer a more cutting-edge mobile fraud technology: Merrill found that at least one of the Chinese phishing groups sells an Android app called &#8220;<strong>ZNFC</strong>&#8221; that can relay a valid NFC transaction to anywhere in the world. The user simply waves their phone at a local payment terminal that accepts Apple or Google pay, and the app relays an NFC transaction over the Internet from a phone in China.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/ekqZjPAxB4c?si=hYLqGPIBrNthAg9_" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&#8220;The software can work from anywhere in the world,&#8221; Merrill said. &#8220;These guys provide the software for $500 a month, and it can relay both NFC enabled tap-to-pay as well as any digital wallet. The even have 24-hour support.&#8221;</p>
<p>The rise of so-called &#8220;ghost tap&#8221; mobile software was <a href="https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay" target="_blank" rel="noopener">first documented in November 2024</a> by security experts at <strong>ThreatFabric</strong>. <strong>Andy Chandler</strong>, the company&#8217;s chief commercial officer, said their researchers have since identified a number of criminal groups from different regions of the world latching on to this scheme.</p>
<p>Chandler said those include organized crime gangs in Europe that are using similar mobile wallet and NFC attacks to take money out of ATMs made to work with smartphones.</p>
<p>&#8220;No one is talking about it, but we&#8217;re now seeing ten different methodologies using the same modus operandi, and none of them are doing it the same,&#8221; Chandler said. &#8220;This is much bigger than the banks are prepared to say.&#8221;</p>
<p>A November 2024 story in the Singapore daily <em>The Straits Times</em> <a href="https://www.straitstimes.com/singapore/scam-syndicates-sending-foreigners-into-singapore-to-cheat-retailers-like-apple-store-and-best-denki" target="_blank" rel="noopener">reported</a> authorities there arrested three foreign men who were recruited in their home countries via social messaging platforms, and given ghost tap apps with which to purchase expensive items from retailers, including mobile phones, jewelry, and gold bars.</p>
<p>&#8220;Since Nov 4, at least 10 victims who had fallen for e-commerce scams have reported unauthorised transactions totaling more than $100,000 on their credit cards for purchases such as electronic products, like iPhones and chargers, and jewelry in Singapore,&#8221; <em>The Straits Times</em> wrote, noting that in another case with a similar modus operandi, the police arrested a Malaysian man and woman on Nov 8.</p>
<div id="attachment_70459" style="width: 863px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70459" decoding="async" loading="lazy" class="size-full wp-image-70459" src="media/98a82431.thestraitstimes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/thestraitstimes.png" alt="" width="853" height="567" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/thestraitstimes.png 853w, https://krebsonsecurity.com/wp-content/uploads/2025/02/thestraitstimes-768x510.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/thestraitstimes-782x520.png 782w" sizes="(max-width: 853px) 100vw, 853px" /><p id="caption-attachment-70459" class="wp-caption-text">Three individuals charged with using ghost tap software at an electronics store in Singapore. Image: The Straits Times.</p></div>
<h2>ADVANCED PHISHING TECHNIQUES</h2>
<p>According to Merrill, the phishing pages that spoof the USPS and various toll road operators are powered by several innovations designed to maximize the extraction of victim data.</p>
<p>For example, a would-be smishing victim might enter their personal and financial information, but then decide the whole thing is scam before actually submitting the data. In this case, anything typed into the data fields of the phishing page will be captured in real time, regardless of whether the visitor actually clicks the &#8220;submit&#8221; button.</p>
<p>Merrill said people who submit payment card data to these phishing sites often are then told their card can&#8217;t be processed, and urged to use a different card. This technique, he said, sometimes allows the phishers to steal more than one mobile wallet per victim.</p>
<p>Many phishing websites expose victim data by storing the stolen information directly on the phishing domain. But Merrill said these Chinese phishing kits will forward all victim data to a back-end database operated by the phishing kit vendors. That way, even when the smishing sites get taken down for fraud, the stolen data is still safe and secure.</p>
<p>Another important innovation is the use of mass-created Apple and Google user accounts through which these phishers send their spam messages. One of the Chinese phishing groups posted images on their Telegram sales channels showing how these robot Apple and Google accounts are loaded onto Apple and Google phones, and arranged snugly next to each other in an expansive, multi-tiered rack that sits directly in front of the phishing service operator.</p>
<div id="attachment_70435" style="width: 528px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70435" decoding="async" loading="lazy" class="size-full wp-image-70435" src="media/5d328b62.phonesashtray.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/phonesashtray.png" alt="" width="518" height="688" /><p id="caption-attachment-70435" class="wp-caption-text">The ashtray says: You&#8217;ve been phishing all night.</p></div>
<p>In other words, the smishing websites are powered by real human operators as long as new messages are being sent. Merrill said the criminals appear to send only a few dozen messages at a time, likely because completing the scam takes manual work by the human operators in China. After all, most one-time codes used for mobile wallet provisioning are generally only good for a few minutes before they expire.</p>
<p>Notably, none of the phishing sites spoofing the toll operators or postal services will load in a regular Web browser; they will only render if they detect that a visitor is coming from a mobile device.</p>
<p>&#8220;One of the reasons they want you to be on a mobile device is they want you to be on the same device that is going to receive the one-time code,&#8221; Merrill said. &#8220;They also want to minimize the chances you will leave. And if they want to get that mobile tokenization and grab your one-time code, they need a live operator.&#8221;</p>
<p>Merrill found the Chinese phishing kits feature another innovation that makes it simple for customers to turn stolen card details into a mobile wallet: They programmatically take the card data supplied by the phishing victim and convert it into a digital image of a real payment card that matches that victim&#8217;s financial institution. That way, attempting to enroll a stolen card into Apple Pay, for example, becomes as easy as scanning the fabricated card image with an iPhone.</p>
<div id="attachment_70439" style="width: 407px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70439" decoding="async" loading="lazy" class="size-full wp-image-70439" src="media/117e5ddc.phish-cabelas.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/phish-cabelas.png" alt="" width="397" height="488" /><p id="caption-attachment-70439" class="wp-caption-text">An ad from a Chinese SMS phishing group&#8217;s Telegram channel showing how the service converts stolen card data into an image of the stolen card.</p></div>
<p>&#8220;The phone isn&#8217;t smart enough to know whether it&#8217;s a real card or just an image,&#8221; Merrill said. &#8220;So it scans the card into Apple Pay, which says okay we need to verify that you&#8217;re the owner of the card by sending a one-time code.&#8221;</p>
<h2>PROFITS</h2>
<p>How profitable are these mobile phishing kits? The best guess so far comes from data gathered by other security researchers who&#8217;ve been tracking these advanced Chinese phishing vendors.</p>
<p>In August 2023, the security firm Resecurity <a href="https://www.resecurity.com/blog/article/smishing-triad-targeted-usps-and-us-citizens-for-data-theft" target="_blank" rel="noopener">discovered a vulnerability</a> in one popular Chinese phish kit vendor&#8217;s platform that exposed the personal and financial data of phishing victims. Resecurity dubbed the group the <strong>Smishing Triad</strong>, and found the gang had harvested 108,044 payment cards across 31 phishing domains (3,485 cards per domain).</p>
<p>In August 2024, security researcher <strong>Grant Smith</strong> gave <a href="https://www.youtube.com/watch?v=gLOv67LlIQs&amp;list=PL9fPq3eQfaaB2scbXRczwvjVH0ckX4bwt&amp;index=14" target="_blank" rel="noopener">a presentation</a> at the DEFCON security conference about tracking down the Smishing Triad after scammers spoofing the U.S. Postal Service <a href="https://www.wired.com/story/usps-scam-text-smishing-triad/" target="_blank" rel="noopener">duped his wife</a>. By identifying a different vulnerability in the gang&#8217;s phishing kit, Smith said he was able to see that people entered 438,669 unique credit cards in 1,133 phishing domains (387 cards per domain).</p>
<p>Based on his research, Merrill said it&#8217;s reasonable to expect between $100 and $500 in losses on each card that is turned into a mobile wallet. Merrill said they observed nearly 33,000 unique domains tied to these Chinese smishing groups during the year between the publication of Resecurity&#8217;s research and Smith&#8217;s DEFCON talk.</p>
<p>Using a median number of 1,935 cards per domain and a conservative loss of $250 per card, that comes out to about $15 billion in fraudulent charges over a year.</p>
<p>Merrill was reluctant to say whether he&#8217;d identified additional security vulnerabilities in any of the phishing kits sold by the Chinese groups, noting that the phishers quickly fixed the vulnerabilities that were detailed publicly by Resecurity and Smith.</p>
<h2>FIGHTING BACK</h2>
<p>Adoption of touchless payments took off in the United States after the Coronavirus pandemic emerged, and many financial institutions in the United States were eager to make it simple for customers to link payment cards to mobile wallets. Thus, the authentication requirement for doing so defaulted to sending the customer a one-time code via SMS.</p>
<p>Experts say the continued reliance on one-time codes for onboarding mobile wallets has fostered this new wave of carding. KrebsOnSecurity interviewed a security executive from a large European financial institution who spoke on condition of anonymity because they were not authorized to speak to the press.</p>
<p>That expert said the lag between the phishing of victim card data and its eventual use for fraud has left many financial institutions struggling to correlate the causes of their losses.</p>
<p>&#8220;That&#8217;s part of why the industry as a whole has been caught by surprise,&#8221; the expert said. &#8220;A lot of people are asking, how this is possible now that we&#8217;ve tokenized a plaintext process. We&#8217;ve never seen the volume of sending and people responding that we&#8217;re seeing with these phishers.&#8221;</p>
<p>To improve the security of digital wallet provisioning, some banks in Europe and Asia require customers to log in to the bank&#8217;s mobile app before they can link a digital wallet to their device.</p>
<p>Addressing the ghost tap threat may require updates to contactless payment terminals, to better identify NFC transactions that are being relayed from another device. But experts say it&#8217;s unrealistic to expect retailers will be eager to replace existing payment terminals before their expected lifespans expire.</p>
<p>And of course Apple and Google have an increased role to play as well, given that their accounts are being created en masse and used to blast out these smishing messages. Both companies could easily tell which of their devices suddenly have 7-10 different mobile wallets added from 7-10 different people around the world. They could also recommend that financial institutions use more secure authentication methods for mobile wallet provisioning.</p>
<p>Neither Apple nor Google responded to requests for comment on this story.</p>


feed_id: https://krebsonsecurity.com/?p=70399
title: Trump 2.0 Brings Cuts to Cyber, Consumer Protections
uri: Trump-2-0-Brings-Cuts-to-Cyber-Consumer-Protections
url: https://krebsonsecurity.com/2025/02/trump-2-0-brings-cuts-to-cyber-consumer-protections/
content:
<p>One month into his second term, President Trump&#8217;s actions to shrink the government through mass layoffs, firings and withholding funds allocated by Congress have thrown federal cybersecurity and consumer protection programs into disarray. At the same time, agencies are battling an ongoing effort by the world&#8217;s richest man to wrest control over their networks and data.</p>
<div id="attachment_70185" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70185" decoding="async" class=" wp-image-70185" src="media/f8c41051.whitehousenight.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/whitehousenight.png" alt="" width="750" height="495" /><p id="caption-attachment-70185" class="wp-caption-text">Image: Shutterstock. Greg Meland.</p></div>
<p>The Trump administration has fired at least 130 employees at the federal government&#8217;s foremost cybersecurity body &#8212; the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA). Those dismissals <a href="https://www.politico.com/news/2025/02/07/trump-guts-cyber-workers-00203087" target="_blank" rel="noopener">reportedly</a> included CISA staff dedicated to securing U.S. elections, and fighting misinformation and foreign influence operations.</p>
<p>Earlier this week, technologists with Elon Musk&#8217;s <strong>Department of Government Efficiency</strong> (DOGE) <a href="https://www.nextgov.com/cybersecurity/2025/02/doge-employee-edward-coristine-lands-cisa-dhs-email/403126/" target="_blank" rel="noopener">arrived at CISA</a> and gained access to the agency&#8217;s email and networked files. Those DOGE staffers include <strong>Edward &#8220;Big Balls&#8221; Coristine</strong>, a <a href="https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/" target="_blank" rel="noopener">19-year-old former denizen of the &#8220;Com,&#8221;</a> an archipelago of Discord and Telegram chat channels that function as a kind of distributed <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/" target="_blank" rel="noopener">cybercriminal social network</a>.</p>
<p>The investigative journalist <strong>Jacob Silverman</strong> <a href="https://www.jacobsilverman.com/p/prominent-doge-staffer-is-grandson" target="_blank" rel="noopener">writes</a> that Coristine is the grandson of <strong>Valery Martynov</strong>, a KGB double agent who spied for the United States. Silverman recounted how Martynov&#8217;s wife <strong>Natalya Martynova</strong> moved to the United States with her two children after her husband&#8217;s death.</p>
<p>&#8220;Her son became a Virginia police officer who sometimes posts comments on blogs about his historically famous father,&#8221; Silverman wrote. &#8220;Her daughter became a financial professional who married Charles Coristine, the proprietor of LesserEvil, a snack company. Among their children is a 19-year-old young man named Edward Coristine, who currently wields an unknown amount of power and authority over the inner-workings of our federal government.&#8221;</p>
<p>Another member of DOGE is <strong>Christopher Stanley</strong>, formerly senior director for security engineering at X and principal security engineer at Musk&#8217;s <strong>SpaceX</strong>. Stanley, 33, had a brush with celebrity on Twitter in 2015 when he leaked the user database for the DDoS-for-hire service <strong>LizardStresser</strong>, and soon faced threats of physical violence against his family.</p>
<p>My <a href="https://krebsonsecurity.com/2015/01/another-lizard-arrested-lizard-lair-hacked/" target="_blank" rel="noopener">2015 story on that leak</a> did not name Stanley, but he exposed himself as the source by posting a video about it on his Youtube channel. A review of domain names registered by Stanley shows he went by the nickname &#8220;enKrypt,&#8221; and was the former owner of a pirated software and hacking forum called <strong>error33[.]net</strong>, as well as <strong>theC0re</strong>, a video game cheating community.</p>
<h2>&#8220;A NATIONAL CYBERATTACK&#8221;</h2>
<p>DOGE has been steadily gaining sensitive network access to federal agencies that hold a staggering amount of personal and financial information on Americans, including the <strong>Social Security Administration </strong>(SSA), the <strong>Department of Homeland Security</strong>, the <strong>Office of Personnel Management</strong> (OPM), and the <strong>Treasury Department</strong>.</p>
<p>Most recently, DOGE has sought broad access to systems at the <strong>Internal Revenue Service</strong> that contain the personal tax information on millions of Americans, including how much individuals earn and owe, property information, and even details related to child custody agreements. The New York Times <a href="https://www.nytimes.com/2025/02/21/us/politics/irs-doge-gavin-kliger.html" target="_blank" rel="noopener">reported Friday</a> that the IRS had reached an agreement whereby a single DOGE employee &#8212; 25-year-old <strong>Gavin Kliger </strong>&#8212; will be allowed to see only anonymized taxpayer information.</p>
<p>The rapidity with which DOGE has rifled through one federal database after another in the name of unearthing &#8220;massive fraud&#8221; by government agencies has alarmed many security experts, who warned that DOGE&#8217;s actions bypassed essential safeguards and security measures.</p>
<p>&#8220;The most alarming aspect isn’t just the access being granted,&#8221; <a href="https://www.schneier.com/blog/archives/2025/02/doge-as-a-national.html" target="_blank" rel="noopener">wrote</a> <strong>Bruce Schneier</strong> and <strong>Davi Ottenheimer</strong>, referring to DOGE as a national cyberattack. &#8220;It&#8217;s the systematic dismantling of security measures that would detect and prevent misuse—including standard incident response protocols, auditing, and change-tracking mechanisms—by removing the career officials in charge of those security measures and replacing them with inexperienced operators.&#8221;</p>
<p><strong>Jacob Williams</strong> is a former hacker with the <strong>U.S. National Security Agency</strong> who now works as managing director of the cybersecurity firm <strong>Hunter Labs</strong>. Williams kicked a virtual hornet&#8217;s nest last week when he posted on LinkedIn that the network incursions by DOGE were &#8220;a bigger threat to U.S. federal government information systems than China.&#8221;</p>
<p>Williams said while he doesn&#8217;t believe anyone at DOGE would intentionally harm the integrity and availability of these systems, it&#8217;s widely reported (and not denied) that DOGE introduced code changes into multiple federal IT systems. These code changes, he maintained, are not following the normal process for vetting and review given to federal government IT systems.</p>
<p>&#8220;For those thinking &#8216;I&#8217;m glad they aren’t following the normal federal government IT processes, those are too burdensome&#8217; I get where you’re coming from,&#8221; Williams <a href="https://www.linkedin.com/pulse/red-tape-security-controls-jacob-williams-adwqe/?trackingId=l8be8vjAEQRKTRSklk%2BZrA%3D%3D" target="_blank" rel="noopener">wrote</a>. &#8220;But another name for &#8216;red tape&#8217; are &#8216;controls.&#8217; If you&#8217;re comfortable bypassing controls for the advancement of your agenda, I have questions – mostly about whether you do this in your day job too. Please tag your employer letting them know your position when you comment that controls aren’t important (doubly so if you work in cybersecurity). All satire aside, if you&#8217;re comfortable abandoning controls for expediency, I implore you to decide where the line is that you won&#8217;t cross in that regard.&#8221;</p>
<p>The DOGE website&#8217;s &#8220;wall of receipts&#8221; boasts that Musk and his team have saved the federal government more than $55 billion through staff reductions, lease cancellations and terminated contracts. But a team of reporters at <strong>The New York Times</strong> found the math that could back up those checks is marred with accounting errors, incorrect assumptions, outdated data and other mistakes.</p>
<p>For example, DOGE claimed it saved $8 billion in one contract, when the total amount was actually $8 million, The Times found.</p>
<p>&#8220;Some contracts the group claims credit for were double- or triple-counted,&#8221; reads <a href="https://www.nytimes.com/2025/02/18/upshot/doge-contracts-musk-trump.html" target="_blank" rel="noopener">a Times story with six bylines</a>. &#8220;Another initially contained an error that inflated the totals by billions of dollars. While the DOGE team has surely cut some number of billions of dollars, its slapdash accounting adds to a pattern of recklessness by the group, which has recently gained access to sensitive government payment systems.&#8221;</p>
<p>So far, the DOGE website does not inspire confidence: We learned last week that the doge.gov administrators somehow left their database wide open, allowing someone to publish messages that <a href="https://arstechnica.com/tech-policy/2025/02/doges-gov-site-lampooned-as-coders-quickly-realize-it-can-be-edited-by-anyone/" target="_blank" rel="noopener">ridiculed the site&#8217;s insecurity</a>.</p>
<div id="attachment_70474" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70474" decoding="async" loading="lazy" class="wp-image-70474" src="media/255febdc.doge-experts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/doge-experts.png" alt="" width="752" height="478" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/doge-experts.png 1371w, https://krebsonsecurity.com/wp-content/uploads/2025/02/doge-experts-768x488.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/doge-experts-782x497.png 782w" sizes="(max-width: 752px) 100vw, 752px" /><p id="caption-attachment-70474" class="wp-caption-text">A screenshot of the DOGE website after it was defaced with the message: &#8220;These &#8216;experts&#8217; left their database open &#8211; roro&#8221;</p></div>
<h2>APPOINTMENTS</h2>
<p>Trump&#8217;s efforts to grab federal agencies by their data has seen him replace career civil servants who refused to allow DOGE access to agency networks. <a href="https://www.cnn.com/2025/02/17/politics/social-security-head-steps-down-doge-access/index.html" target="_blank" rel="noopener">CNN reports</a> that <strong>Michelle King</strong>, acting commissioner of the Social Security Administration for more than 30 years, was shown the door after she denied DOGE access to sensitive information.</p>
<p>King was replaced by <strong>Leland Dudek</strong>, formerly a senior advisor in the SSA&#8217;s Office of Program Integrity. This week, Dudek posted a now-deleted message on LinkedIn acknowledging he had been placed on administrative leave for cooperating with DOGE.</p>
<p>&#8220;I confess,&#8221; Dudek wrote. &#8220;I bullied agency executives, shared executive contact information, and circumvented the chain of command to connect DOGE with the people who get stuff done. I confess. I asked where the fat was and is in our contracts so we can make the right tough choices.&#8221;</p>
<div id="attachment_70473" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70473" decoding="async" loading="lazy" class="wp-image-70473" src="media/3cdaade5.dudek-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/dudek-li.png" alt="" width="750" height="627" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/dudek-li.png 853w, https://krebsonsecurity.com/wp-content/uploads/2025/02/dudek-li-768x642.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/dudek-li-782x654.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70473" class="wp-caption-text">Dudek&#8217;s message on LinkedIn.</p></div>
<p>According to Wired, the <strong>National Institute of Standards and Technology</strong> (NIST) was also bracing this week for roughly 500 staffers to be fired, which could have serious impacts on NIST’s cybersecurity standards and software vulnerability tracking work.</p>
<p>&#8220;And cuts last week at the US Digital Service included the cybersecurity lead for the central Veterans Affairs portal, VA.gov, potentially leaving VA systems and data more vulnerable without someone in his role,&#8221; Wired&#8217;s Andy Greenberg and Lily Hay Newman <a href="https://www.wired.com/story/1-4-billion-stolen-from-bybit-in-biggest-crypto-theft-ever/" target="_blank" rel="noopener">wrote</a>.</p>
<p>NextGov <a href="https://www.nextgov.com/defense/2025/02/katie-arrington-announces-she-dods-new-ciso/403091/?oref=ng-homepage-river" target="_blank" rel="noopener">reports</a> that Trump named the Department of Defense&#8217;s new chief information security officer: <strong>Katie Arrington</strong>, a former South Carolina state lawmaker who helped steer Pentagon cybersecurity contracting policy before being put on leave amid accusations that she disclosed classified data from a military intelligence agency.</p>
<p>NextGov notes that the <strong>National Security Agency</strong> suspended her clearance in 2021, although the exact reasons that led to the suspension and her subsequent leave were classified. Arrington argued that the suspension was a politically motivated effort to silence her.</p>
<p>Trump also appointed the former chief operating officer of the <strong>Republican National Committee</strong> as the new head of the Office of National Cyber Director. <strong>Sean Cairncross</strong>, who has no formal experience in technology or security, will be responsible for coordinating national cybersecurity policy, advising the president on cyber threats, and ensuring a unified federal response to emerging cyber-risks, Politico <a href="https://www.politico.com/news/2025/02/11/sean-cairncross-cyber-director-nomination-00203759" target="_blank" rel="noopener">writes</a>.</p>
<p><strong>DarkReading</strong> <a href="https://www.darkreading.com/cyber-risk/president-trump-nominate-former-rnc-official-national-cyber-director" target="_blank" rel="noopener">reports</a> that Cairncross would share responsibility for advising the president on cyber matters, along with the director of cyber at the White House National Security Council (NSC) — a group that advises the president on all matters security related, and not just cyber.</p>
<h2>CONSUMER PROTECTION?</h2>
<p>The president also ordered staffers at the <strong>Consumer Financial Protection Bureau</strong> (CFPB) to stop most work. Created by Congress in 2011 to be a clearinghouse of consumer complaints, the CFPB has sued some of the nation&#8217;s largest financial institutions for violating consumer protection laws.</p>
<p>The CFPB says its actions have put nearly $18 billion back in Americans&#8217; pockets in the form of monetary compensation or canceled debts, and imposed $4 billion in civil money penalties against violators. The CFPB&#8217;s homepage has featured a &#8220;404: Page not found&#8221; error for weeks now.</p>
<p>Trump has appointed <strong>Russell Vought</strong>, the architect of the conservative policy playbook <strong>Project 2025</strong>, to be the CFPB&#8217;s acting director. Vought has publicly favored abolishing the agency, as has Elon Musk, whose efforts to remake X into a payments platform would otherwise be regulated by the CFPB.</p>
<p>The New York Times recently published a useful graphic showing all of the government staffing changes, including the firing of several top officials, affecting agencies with federal investigations into or regulatory battles with Musk&#8217;s companies. Democrats on the House Judiciary Committee also have released <a href="media/f770785e.2025.02.13_fact_sheet_re_musk_investigations.pdf" data-original-source="https://democrats-judiciary.house.gov/uploadedfiles/2025.02.13_fact_sheet_re_musk_investigations.pdf" target="_blank" rel="noopener">a comprehensive account (PDF)</a> of Musk&#8217;s various conflicts of interest.</p>
<div id="attachment_70476" style="width: 740px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70476" decoding="async" loading="lazy" class="wp-image-70476" src="media/bc55279e.newyorktimes-musk-conflicts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/newyorktimes-musk-conflicts.png" alt="" width="730" height="653" /><p id="caption-attachment-70476" class="wp-caption-text">Image: nytimes.com</p></div>
<p>As the Times notes, Musk and his companies have repeatedly failed to comply with federal reporting protocols aimed at protecting state secrets, and these failures have prompted at least three federal reviews. Those include an inquiry launched last year by the Defense Department&#8217;s Office of Inspector General. Four days after taking office, Trump fired the DoD inspector general along with 17 other inspectors general.</p>
<p>The Trump administration also shifted the enforcement priorities of the <strong>U.S. Securities and Exchange Commission</strong> (SEC) away from prosecuting misconduct in the cryptocurrency sector, reassigning lawyers and <a href="https://www.sec.gov/newsroom/press-releases/2025-42" target="_blank" rel="noopener">renaming the unit</a> to focus more on &#8220;cyber and emerging technologies.&#8221;</p>
<p>Reuters <a href="https://www.reuters.com/technology/us-securities-regulator-drop-lawsuit-against-coinbase-exchange-says-2025-02-21/#:~:text=Feb%2021%20(Reuters)%20%2D%20Coinbase,platform%20and%20the%20broader%20sector." target="_blank" rel="noopener">reports</a> that the former SEC chair <strong>Gary Gensler</strong> made fighting misconduct in a sector he termed the &#8220;wild west&#8221; a priority for the agency, targeting not only cryptocurrency fraudsters but also the large firms that facilitate trading such as <strong>Coinbase</strong>.</p>
<p>On Friday, Coinbase said the SEC planned to withdraw its lawsuit against the crypto exchange. Also on Friday, the cryptocurrency exchange <strong>Bybit</strong> <a href="https://therecord.media/hackers-drained-bybit-crypto-exchange-hack" target="_blank" rel="noopener">announced on X</a> that a cybersecurity breach led to the theft of more than $1.4 billion worth of cryptocurrencies &#8212; making it the largest crypto heist ever.<span id="more-70399"></span></p>
<h2>ORGANIZED CRIME AND CORRUPTION</h2>
<p>On Feb. 10, Trump <a href="https://www.whitehouse.gov/presidential-actions/2025/02/pausing-foreign-corrupt-practices-act-enforcement-to-further-american-economic-and-national-security/" target="_blank" rel="noopener">ordered</a> executive branch agencies to stop enforcing the <strong>U.S. Foreign Corrupt Practices Act</strong>, which froze foreign bribery investigations, and even allows for &#8220;remedial actions&#8221; of past enforcement actions deemed &#8220;inappropriate.&#8221;</p>
<p>Trump&#8217;s action also disbanded the <strong>Kleptocracy Asset Recovery Initiative</strong> and <strong>KleptoCapture Task Force</strong> &#8212; units which proved their value in corruption cases and in seizing the assets of sanctioned Russian oligarchs &#8212; and diverted resources away from investigating white-collar crime.</p>
<p>That&#8217;s according to the independent <strong>Organized Crime and Corruption Reporting Project</strong> (OCCRP), an investigative journalism outlet that until very recently was funded in part by the <strong>U.S. Agency for International Development</strong> (USAID).</p>
<p>The <a href="https://www.occrp.org/en" target="_blank" rel="noopener">OCCRP</a> lost nearly a third of its funding and was forced to lay off 43 reporters and staff after Trump moved to shutter USAID and freeze its spending. NBC News <a href="https://www.nbcnews.com/politics/politics-news/usaid-reduce-foreign-service-officers-trump-cuts-federal-government-rcna191122" target="_blank" rel="noopener">reports</a> the Trump administration plans to gut the agency and leave fewer than 300 staffers on the job out of the current 8,000 direct hires and contractors.</p>
<p>The <strong>Global Investigative Journalism Network</strong> <a href="https://gijn.org/stories/usaid-crisis-funding-future-independent-media/" target="_blank" rel="noopener">wrote</a> this week that the sudden hold on USAID foreign assistance funding has frozen an estimated $268 million in agreed grants for independent media and the free flow of information in more than 30 countries &#8212; including several under repressive regimes.</p>
<p>Elon Musk has called USAID &#8220;a criminal organization&#8221; without evidence, and <a href="https://www.nbcnews.com/politics/doge/elon-musk-boosted-false-usaid-conspiracy-theories-global-aid-rcna190646" target="_blank" rel="noopener">promoted fringe theories</a> on his social media platform X that the agency operated without oversight and was rife with fraud. Just months before the election, USAID&#8217;s Office of Inspector General <a href="https://oig.usaid.gov/node/6814" target="_blank" rel="noopener">announced</a> an investigation into USAID&#8217;s oversight of Starlink satellite terminals provided to the government of Ukraine.</p>
<p>KrebsOnSecurity this week heard from a trusted source that all outgoing email from USAID now carries a notation of &#8220;<a href="https://fam.state.gov/fam/12fam/12fam0540.html" target="_blank" rel="noopener">sensitive but unclassified</a>,&#8221; a designation that experts say could make it more difficult for journalists and others to obtain USAID email records under the Freedom of Information Act (FOIA). On Feb. 20, Fedscoop <a href="https://fedscoop.com/usaid-emails-sensitive-but-unclassified-foia/" target="_blank" rel="noopener">reported</a> also hearing the same thing from multiple sources, noting that the added message cannot be seen by senders until after the email is sent.</p>
<h2>FIVE BULLETS</h2>
<p>On Feb. 18, Trump issued <a href="https://www.whitehouse.gov/presidential-actions/2025/02/ensuring-accountability-for-all-agencies/" target="_blank" rel="noopener">an executive order</a> declaring that only the U.S. attorney general and the president can provide authoritative interpretations of the law for the executive branch, and that this authority extends to independent agencies operating under the executive branch.</p>
<p>Trump is arguing that Article II, Clause 1 of the Constitution vests this power with the president. However, jurist.org <a href="https://www.jurist.org/news/2025/02/trump-signs-order-declaring-only-president-and-ag-can-interpret-us-law-for-executive-branch/" target="_blank" rel="noopener">writes</a> that Article II does not expressly state the president or any other person in the executive branch has the power to interpret laws.</p>
<p>&#8220;The article states that the president is required to &#8216;take care that the laws be faithfully executed,'&#8221; Juris noted. &#8220;Jurisdiction to interpret laws and determine constitutionality belongs to the judicial branch under Article III. The framers of the Constitution designed the separation of duties to prevent any single branch of government from becoming too powerful.&#8221;</p>
<p>The executive order requires all agencies to submit to &#8220;performance standards and management objectives&#8221; to be established by the White House Office of Management and Budget, and to report periodically to the president.</p>
<p>Those performance metrics are already being requested: Employees at multiple federal agencies on Saturday reported receiving an email from the <strong>Office of Personnel Management</strong> ordering them to reply with a set of bullet points justifying their work for the past week.</p>
<p>&#8220;Please reply to this email with approx. 5 bullets of what you accomplished last week and cc your manager,&#8221; the notice read. &#8220;Please do not send any classified information, links, or attachments. Deadline is this Monday at 11:59 p.m. EST.&#8221;</p>
<div id="attachment_70477" style="width: 490px" class="wp-caption aligncenter"><a href="media/8709016f.agencyusers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/agencyusers.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70477" decoding="async" loading="lazy" class="wp-image-70477 size-full" src="media/8709016f.agencyusers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/agencyusers.png" alt="" width="480" height="783" /></a><p id="caption-attachment-70477" class="wp-caption-text">An email sent by the OPM to more than two million federal employees late in the afternoon EST on Saturday, Feb. 22.</p></div>
<p>In a social media post Saturday, Musk said the directive came at the behest of President Trump, and that failure to respond would be taken as a resignation. Meanwhile, Bloomberg <a href="https://www.bloomberg.com/news/articles/2025-02-23/doj-heads-tell-staff-not-to-reply-to-musk-demand-for-job-details" target="_blank" rel="noopener">writes</a> the <strong>Department of Justice</strong> has been urging employees to hold off replying out of concern doing so could trigger ethics violations. The <strong>National Treasury Employees Union</strong> also is <a href="media/c22b1652.nteu-advisory.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/nteu-advisory.png" target="_blank" rel="noopener">advising its employees not to respond</a>.</p>
<p>A legal battle over Trump&#8217;s latest executive order is bound to join <a href="https://www.courtwatch.news/p/lawsuits-related-to-trump-admin-executive-orders" target="_blank" rel="noopener">more than 70 other lawsuits</a> currently underway to halt the administration&#8217;s efforts to massively reduce the size of the federal workforce through layoffs, firings and attrition.</p>
<h2>KING TRUMP?</h2>
<p>On Feb. 15, the president posted on social media, &#8220;He who saves his Country does not violate any Law,&#8221; citing a quote often attributed to the French dictator Napoleon Bonaparte. Four days later, Trump referred to himself as &#8220;the king&#8221; on social media, while the White House nonchalantly posted an illustration of him wearing a crown.</p>
<p>Trump has been <a href="https://www.washingtonpost.com/politics/2025/02/20/trump-third-term-king-unconstitutional/" target="_blank" rel="noopener">publicly musing about running for an unconstitutional third-term in office</a>, a statement that some of his supporters dismiss as Trump just trying to rile his liberal critics. However, just days after Trump began his second term, <strong>Rep. Andy Ogles</strong> (R-Tenn.) <a href="https://www.cnbc.com/2025/01/23/trump-third-term-amendment-constitution-ogles.html" target="_blank" rel="noopener">introduced a bill</a> to amend the Constitution so that Trump &#8212; and any other future president &#8212; can be elected to serve a third term.</p>
<p>This week at the <strong>Conservative Political Action Conference</strong> (CPAC), Rep. Ogles reportedly led a group of Trump supporters calling itself the &#8220;Third Term Project,&#8221; which is trying to gain support for the bill from GOP lawmakers. The event featured images of Trump depicted as Caesar.</p>
<div id="attachment_70475" style="width: 618px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70475" decoding="async" loading="lazy" class="size-full wp-image-70475" src="media/e657976c.thirdtermproject.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/thirdtermproject.png" alt="" width="608" height="733" /><p id="caption-attachment-70475" class="wp-caption-text">A banner at the CPAC conference this week in support of The Third Term Project, a group of conservatives trying to gain support for a bill to amend the Constitution and allow Trump to run for a third term.</p></div>
<p>Russia continues to be among the world&#8217;s top exporters of cybercrime, narcotics, money laundering, human trafficking, disinformation, war and death, and yet the Trump administration has suddenly broken with the Western world in normalizing relations with Moscow.</p>
<p>This week President Trump stunned U.S. allies by repeating Kremlin talking points that Ukraine is somehow responsible for Russia&#8217;s invasion, and that <strong>Ukrainian President Volodymyr Zelensky</strong> is a &#8220;dictator.&#8221; The president repeated these lies even as his administration is demanding that Zelensky give the United States half of his country&#8217;s mineral wealth in exchange for a promise that Russia will cease its territorial aggression there.</p>
<p>President Trump&#8217;s servility toward <a href="media/1e041133.thisisadictator.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/thisisadictator.png" target="_blank" rel="noopener">an actual dictator</a> &#8212; <strong>Russian President Vladimir Putin</strong> &#8212; does not bode well for efforts to improve the cybersecurity of U.S. federal IT networks, or the private sector systems on which the government is largely reliant. In addition, this administration&#8217;s baffling moves to alienate, antagonize and sideline our closest allies could make it more difficult for the United States to secure their ongoing cooperation in cybercrime investigations.</p>
<p>It&#8217;s also startling how closely DOGE&#8217;s approach so far hews to tactics typically employed by ransomware gangs: A group of 20-somethings with names like &#8220;Big Balls&#8221; shows up on a weekend and gains access to your servers, deletes data, locks out key staff, takes your website down, and prevents you from serving customers.</p>
<p>When the federal executive starts imitating ransomware playbooks against its own agencies while Congress largely gazes on in either bewilderment or amusement, we&#8217;re in four-alarm fire territory. At least in theory, one can negotiate with ransomware purveyors.</p>


feed_id: https://krebsonsecurity.com/?p=70530
title: U.S. Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason”
uri: 2025-02-27-
url:
https://krebsonsecurity.com/2025/02/u-s-soldier-charged-in-att-hack-searched-can-hacking-be-treason/

content:
<p>A U.S. Army soldier who pleaded guilty last week to leaking phone records for high-ranking U.S. government officials searched online for non-extradition countries and for an answer to the question &#8220;can hacking be treason?&#8221; prosecutors in the case said Wednesday. The government disclosed the details in a court motion to keep the defendant in custody until he is discharged from the military.</p>
<div id="attachment_69974" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69974" decoding="async" class=" wp-image-69974" src="media/72159dd7.camwagenius-selfie.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/12/camwagenius-selfie.png" alt="" width="747" height="740" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/12/camwagenius-selfie.png 779w, https://krebsonsecurity.com/wp-content/uploads/2024/12/camwagenius-selfie-768x761.png 768w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-69974" class="wp-caption-text">One of several selfies on the Facebook page of Cameron Wagenius.</p></div>
<p><strong>Cameron John Wagenius</strong>, 20, was <a href="https://krebsonsecurity.com/2024/12/u-s-army-soldier-arrested-in-att-verizon-extortions/" target="_blank" rel="noopener">arrested</a> near the Army base in Fort Cavazos, Texas on Dec. 20, and charged with two criminal counts of unlawful transfer of confidential phone records. Wagenius was a communications specialist at a U.S. Army base in South Korea, who secretly went by the nickname <strong>Kiberphant0m</strong> and was part of a trio of criminal hackers that extorted dozens of companies last year over stolen data.</p>
<p>At the end of 2023, malicious hackers learned that many companies had uploaded sensitive customer records to accounts at the cloud data storage service <strong>Snowflake</strong> that were protected with little more than a username and password (no multi-factor authentication needed). After scouring darknet markets for stolen Snowflake account credentials, the hackers began raiding the data storage repositories used by some of the world&#8217;s largest corporations.</p>
<p>Among those was <strong>AT&amp;T</strong>, which disclosed in July that cybercriminals had stolen personal information and phone and text message records for roughly 110 million people — nearly all of its customers. AT&amp;T <a href="https://www.wired.com/story/atandt-paid-hacker-300000-to-delete-stolen-call-records/" target="_blank" rel="noopener">reportedly</a> paid a hacker $370,000 to delete stolen phone records. More than 160 other Snowflake customers were relieved of data, including TicketMaster, Lending Tree, Advance Auto Parts and Neiman Marcus.</p>
<p>In several posts to an English-language cybercrime forum in November, Kiberphant0m leaked some of the phone records and threatened to leak them all unless paid a ransom. Prosecutors said that in addition to his public posts on the forum, Wagenius had engaged in multiple direct attempts to extort &#8220;Victim-1,&#8221; which appears to be a reference to AT&amp;T. The government states that Kiberphant0m privately demanded $500,000 from Victim-1, threatening to release all of the stolen phone records unless he was paid.</p>
<p>On Feb. 19, Wagenius <a href="media/0e8c1cde.gov.uscourts.wawd.343000.27.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.wawd.343000/gov.uscourts.wawd.343000.27.0.pdf" target="_blank" rel="noopener">pleaded guilty</a> to two counts of unlawfully transferring confidential phone records, but he did so without the benefit of a plea agreement. In entering the plea, Wagenius&#8217;s attorneys had asked the court to allow him to stay with his father pending his sentencing.</p>
<p>But in <a href="media/5bf768fb.gov.uscourts.wawd.343000.30.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.wawd.343000/gov.uscourts.wawd.343000.30.0.pdf" target="_blank" rel="noopener">a response filed today</a> (PDF), prosecutors in Seattle said Wagenius was a flight risk, partly because prior to his arrest he was searching online for how to defect to countries that do not extradite to the United States. According to the government, while Kiberphant0m was extorting AT&amp;T, Wagenius&#8217;s searches included:</p>
<p>-&#8220;where can i defect the u.s government military which country will not hand me over&#8221;<br />
-&#8220;U.S. military personnel defecting to Russia&#8221;<br />
-&#8220;Embassy of Russia – Washington, D.C.&#8221;</p>
<p>&#8220;As discussed in the government’s sealed filing, the government has uncovered evidence suggesting that the charged conduct was only a small part of Wagenius’ malicious activity,&#8221; the government memo states. &#8220;On top of this, for more than two weeks in November 2024, Wagenius communicated with an email address he believed belonged to Country-1’s military intelligence service in an attempt to sell stolen information. Days after he apparently finished communicating with Country-1’s military intelligence service, Wagenius Googled, &#8216;can hacking be treason.'&#8221;<span id="more-70530"></span></p>
<p>Prosecutors told the court investigators also found a screenshot on Wagenius&#8217; laptop that suggested he had over 17,000 files that included passports, driver’s licenses, and other identity cards belonging to victims of a breach, and that in one of his online accounts, the government also found a fake identification document that contained his picture.</p>
<p>&#8220;Wagenius should also be detained because he presents a serious risk of flight, has the means and intent to flee, and is aware that he will likely face additional charges,&#8221; the Seattle prosecutors asserted.</p>
<p>The court filing says Wagenius is presently in the process of being separated from the Army, but the government has not received confirmation that his discharge has been finalized.</p>
<p>&#8220;The government’s understanding is that, until his discharge from the Army is finalized (which is expected to happen in early March), he may only be released directly to the Army,&#8221; reads a footnote in the memo. &#8220;Until that process is completed, Wagenius’ proposed release to his father should be rejected for this additional reason.&#8221;</p>
<p>Wagenius&#8217;s interest in defecting to another country in order to escape prosecution mirrors that of his alleged co-conspirator, <strong>John Erin Binns</strong>, an 25-year-old elusive American man indicted by the Justice Department for <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">a 2021 breach at T-Mobile</a> that exposed the personal information of at least 76.6 million customers.</p>
<p>Binns has since been charged with the Snowflake hack and subsequent extortion activity. He is currently in custody in a Turkish prison. Sources close to the investigation told KrebsOnSecurity that prior to his arrest by Turkish police, Binns visited the Russian embassy in Turkey to inquire about Russian citizenship.</p>
<p>In late November 2024, Canadian authorities <a href="https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/" target="_blank" rel="noopener">arrested a third alleged member of the extortion conspiracy</a>, 25-year-old <strong>Connor Riley Moucka</strong> of Kitchener, Ontario. The U.S. government has indicted Moucka and Binns, charging them with one count of conspiracy; 10 counts of wire fraud; four counts of computer fraud and abuse; two counts of extortion in relation to computer fraud; and two counts aggravated identity theft.</p>
<p>Less than a month before Wagenius&#8217;s arrest, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/" target="_blank" rel="noopener">a deep dive</a> into Kiberphant0m&#8217;s various Telegram and Discord identities over the years, revealing how the owner of the accounts told others they were in the Army and stationed in South Korea.</p>
<p>The maximum penalty Wagenius could face at sentencing includes up to ten years in prison for each count, and fines not to exceed $250,000.</p>


feed_id: https://krebsonsecurity.com/?p=70525
title: Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab
uri: Notorious-Malware-Spam-Host-Prospero-Moves-to-Kaspersky-Lab
url: https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/
content:
<p>One of the most notorious providers of abuse-friendly &#8220;bulletproof&#8221; web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm <strong>Kaspersky Lab</strong>, KrebsOnSecurity has learned.</p>
<p>Security experts say the Russia-based service provider <strong>Prospero OOO </strong>(the triple O is the Russian version of &#8220;LLC&#8221;) has long been a persistent source of malicious software, botnet controllers, and <a href="https://urlscan.io/search/#page.asn%3Aas200593" target="_blank" rel="noopener">a torrent of phishing websites</a>. Last year, the French security firm <strong>Intrinsec</strong> <a href="https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/" target="_blank" rel="noopener">detailed</a> Prospero&#8217;s connections to bulletproof services advertised on Russian cybercrime forums under the names <strong>Securehost</strong> and <strong>BEARHOST</strong>.</p>
<div id="attachment_70550" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70550" decoding="async" class=" wp-image-70550" src="media/05abd291.bearhost.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/bearhost.png" alt="" width="749" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/bearhost.png 902w, https://krebsonsecurity.com/wp-content/uploads/2025/02/bearhost-768x504.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/bearhost-782x513.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70550" class="wp-caption-text">The bulletproof hosting provider BEARHOST. This screenshot has been machine-translated from Russian. Image: Ke-la.com.</p></div>
<p>Bulletproof hosts are so named when they earn or cultivate a reputation for ignoring legal demands and abuse complaints. And BEARHOST has been cultivating its reputation since at least 2019.</p>
<p>&#8220;If you need a server for a botnet, for malware, brute, scan, phishing, fakes and any other tasks, please contact us,&#8221; BEARHOST&#8217;s ad on one forum advises. &#8220;We completely ignore all abuses without exception, including SPAMHAUS and other organizations.&#8221;</p>
<p>Intrinsec found Prospero has courted some of Russia&#8217;s nastiest cybercrime groups, hosting control servers for multiple ransomware gangs over the past two years. Intrinsec said its analysis showed Prospero frequently hosts malware operations such as <a href="https://www.reliaquest.com/blog/new-python-socgholish-infection-chain/" target="_blank" rel="noopener">SocGholish</a> and <a href="https://redcanary.com/threat-detection-report/threats/gootloader/" target="_blank" rel="noopener">GootLoader</a>, which are spread primarily via fake browser updates on hacked websites and often lay the groundwork for more serious cyber intrusions &#8212; including ransomware.</p>
<div id="attachment_70548" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70548" decoding="async" loading="lazy" class=" wp-image-70548" src="media/8eb9ec5d.fakeupdates.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/fakeupdates.png" alt="" width="749" height="361" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/fakeupdates.png 1121w, https://krebsonsecurity.com/wp-content/uploads/2025/02/fakeupdates-768x371.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/fakeupdates-782x377.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70548" class="wp-caption-text">A fake browser update page pushing mobile malware. Image: Intrinsec.</p></div>
<p>BEARHOST prides itself on the ability to evade blocking by <a href="https://www.spamhaus.org" target="_blank" rel="noopener">Spamhaus</a>, an organization that many Internet service providers around the world rely on to help identify and block sources of malware and spam. Earlier this week, Spamhaus said it <a href="https://www.cidr-report.org/cgi-bin/as-report?as=AS200593" target="_blank" rel="noopener">noticed</a> that Prospero was suddenly connecting to the Internet by routing through networks operated by Kaspersky Lab in Moscow.</p>
<p>Kaspersky did not respond to repeated requests for comment.</p>
<p>Kaspersky began selling antivirus and security software in the United States in 2005, and the company&#8217;s malware researchers have earned accolades from the security community for many important discoveries over the years. But in September 2017, the Department of Homeland Security (DHS) barred U.S. federal agencies from using Kaspersky software, mandating its removal within 90 days.<span id="more-70525"></span></p>
<p>Cybersecurity reporter <strong>Kim Zetter</strong> notes that DHS didn&#8217;t cite any specific justification for its ban in 2017, but media reports quoting anonymous government officials referenced two incidents. Zetter wrote:</p>
<blockquote><p>According to one story, an NSA contractor developing offensive hacking tools for the spy agency had Kaspersky software installed on his home computer where he was developing the tools, and the software detected the source code as malicious code and extracted it from his computer, as antivirus software is designed to do. A second story claimed that Israeli spies caught Russian government hackers using Kaspersky software to search customer systems for files containing U.S. secrets.</p>
<p>Kaspersky denied that anyone used its software to search for secret information on customer machines and said that the tools on the NSA worker&#8217;s machine were detected in the same way that all antivirus software detects files it deems suspicious and then quarantines or extracts them for analysis. Once Kaspersky discovered that the code its antivirus software detected on the NSA worker&#8217;s machine were not malicious programs but source code in development by the U.S. government for its hacking operations, CEO Eugene Kaspersky says he ordered workers to delete the code.</p></blockquote>
<p>Last year, the U.S. Commerce Department <a href="https://www.zetter-zeroday.com/kaspersky-lab-closing-u-s-division-laying-off-workers-2/" target="_blank" rel="noopener">banned the sale of Kaspersky software in the U.S.</a> effective July 20, 2024. U.S. officials argued the ban was needed because Russian law requires domestic companies to cooperate in all official investigations, and thus the Russian government could force Kaspersky to secretly gather intelligence on its behalf.</p>
<p>Phishing data gathered last year by the <strong>Interisle Consulting Group</strong> ranked hosting networks by their size and concentration of spambot hosts, and <a href="https://www.cybercrimeinfocenter.org/spam-activity-in-hosting-networks-december-february-2024" target="_blank" rel="noopener">found</a> Prospero had a higher spam score than any other provider by far.</p>
<div id="attachment_70549" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70549" decoding="async" loading="lazy" class=" wp-image-70549" src="media/c76d0294.cidr-as200593.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/cidr-as200593.png" alt="" width="748" height="483" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/cidr-as200593.png 896w, https://krebsonsecurity.com/wp-content/uploads/2025/02/cidr-as200593-768x495.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/cidr-as200593-782x504.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-70549" class="wp-caption-text">AS209030, owned by Kaspersky Lab, is providing connectivity to the bulletproof host Prospero (AS200593). Image: cidr-report.org.</p></div>
<p>It remains unclear why Kaspersky is providing transit to Prospero. <strong>Doug Madory</strong>, director of Internet analysis at <strong>Kentik</strong>, said routing records show the relationship between Prospero and Kaspersky started at the beginning of December 2024.</p>
<p>Madory said Kaspersky&#8217;s network appears to be <a href="https://www.cidr-report.org/cgi-bin/as-report?as=AS209030&amp;v=4&amp;view=2.0" target="_blank" rel="noopener">hosting several financial institutions</a>, including Russia&#8217;s largest &#8212; <strong>Alfa-Bank</strong>. Kaspersky sells services to help protect customers from distributed denial-of-service (DDoS) attacks, and Madory said it could be that Prospero is simply purchasing that protection from Kaspersky.</p>
<p>But if that is the case, it doesn&#8217;t make the situation any better, said <strong>Zach Edwards</strong>, a senior threat researcher at the security firm <strong>Silent Push</strong>.</p>
<p>&#8220;In some ways, providing DDoS protection to a well-known bulletproof hosting provider may be even worse than just allowing them to connect to the rest of the Internet over your infrastructure,&#8221; Edwards said.</p>


feed_id: https://krebsonsecurity.com/?p=70579
title: Who is the DOGE and X Technician Branden Spikes?
uri: Who-is-the-DOGE-and-X-Technician-Branden-Spikes
url: https://krebsonsecurity.com/2025/03/who-is-the-doge-and-x-technician-branden-spikes/
content:
<p>At 49, <strong>Branden Spikes</strong> isn&#8217;t just one of the oldest technologists who has been involved in Elon Musk&#8217;s <strong>Department of Government Efficiency</strong> (DOGE). As the current director of information technology at <strong>X/Twitter</strong> and an early hire at <strong>PayPal</strong>, <strong>Zip2</strong>,<strong> Tesla</strong> and <strong>SpaceX</strong>, Spikes is also among Musk&#8217;s most loyal employees. Here&#8217;s a closer look at this trusted Musk lieutenant, whose Russian ex-wife was once married to Elon&#8217;s cousin.</p>
<div id="attachment_70586" style="width: 601px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70586" decoding="async" class="size-full wp-image-70586" src="media/0306a12c.x-spikes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/x-spikes.png" alt="" width="591" height="533" /><p id="caption-attachment-70586" class="wp-caption-text">The profile of Branden Spikes on X.</p></div>
<p>When President Trump took office again in January, he put the world&#8217;s richest man &#8212; Elon Musk &#8212; in charge of the <strong>U.S. Digital Service</strong>, and renamed the organization as DOGE. The group is reportedly staffed by <a href="https://www.nytimes.com/interactive/2025/02/27/us/politics/doge-staff-list.html" target="_blank" rel="noopener">at least 50 technologists</a>, many of whom have ties to Musk&#8217;s companies.</p>
<p>DOGE has been enabling the president&#8217;s ongoing mass layoffs and firings of federal workers, largely by seizing control over computer systems and government data for a multitude of federal agencies, including the Social Security Administration, the Department of Homeland Security, the Office of Personnel Management, and the Treasury Department.</p>
<p>It is difficult to find another person connected to DOGE who has stronger ties to Musk than Branden Spikes. A native of California, Spikes initially teamed up with Musk in 1997 as a lead systems engineer for the software company Zip2, the first major venture for Musk. In 1999, Spikes was hired as director of IT at PayPal, and in 2002 he became just the fourth person hired at SpaceX.</p>
<p>In 2012, Spikes launched <strong>Spikes Security</strong>, a software product that sought to create a compartmentalized or &#8220;sandboxed&#8221; web browser that could insulate the user from malware attacks. A review of spikes.com in the Wayback Machine shows that as far back as 1998, Musk could be seen joining Spikes for team matches in the online games Quake and Quake II. In 2016, Spikes Security was merged with another security suite called Aurionpro, with the combined company renamed Cyberinc.</p>
<div id="attachment_70608" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70608" decoding="async" loading="lazy" class=" wp-image-70608" src="media/c300f7e4.spikesquake.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/spikesquake.png" alt="" width="748" height="682" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/spikesquake.png 879w, https://krebsonsecurity.com/wp-content/uploads/2025/03/spikesquake-768x700.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/spikesquake-782x713.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-70608" class="wp-caption-text">A snapshot of spikes.com from 1998 shows Elon Musk&#8217;s profile in Spike&#8217;s clan for the games Quake and Quake II.</p></div>
<p>Spikes&#8217;s <a href="https://www.linkedin.com/in/brandenspikes/" target="_blank" rel="noopener">LinkedIn profile</a> says he was appointed head of IT at X in February 2025. And although his name shows up on none of the lists of DOGE employees circulated by various media outlets, multiple sources told KrebsOnSecurity that Spikes was working with DOGE and operates within Musk&#8217;s inner circle of trust.</p>
<p>In a conversation with KrebsOnSecurity, Spikes said he is dedicated to his country and to saving it from what he sees as certain ruin.</p>
<p>&#8220;Myself, I was raised by a southern conservative family in California and I strongly believe in America and her future,&#8221; Spikes said. &#8220;This is why I volunteered for two months in DC recently to help DOGE save us from certain bankruptcy.&#8221;</p>
<p>Spikes told KrebsOnSecurity that he recently decided to head back home and focus on his job as director of IT at X.</p>
<p>&#8220;I loved it, but ultimately I did not want to leave my hometown and family back in California,&#8221; Spikes said of his tenure at DOGE. &#8220;After a couple of months it became clear that to continue helping I would need to move to DC and commit a lot more time, so I politely bowed out.&#8221;</p>
<p>Prior to founding Spikes Security, Branden Spikes was married to a native Russian woman named <strong>Natalia</strong> whom he&#8217;d met at a destination wedding in South America in 2003.</p>
<p>Branden and Natalia&#8217;s names are both on the registration records for the domain name <strong>orangetearoom[.]com</strong>. This domain, which DomainTools.com says was originally registered by Branden in 2009, is the home of a tax-exempt charity in Los Angeles called the <a href="https://web.archive.org/web/20141221061648/http://www.russiancalifornia.org/" target="_blank" rel="noopener"><strong>California Russian Association</strong></a>.</p>
<p>Here is a photo from a 2011 event organized by the California Russian Association, showing Branden and Natalia at one of its &#8220;White Nights&#8221; charity fundraisers:</p>
<div id="attachment_70585" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70585" decoding="async" loading="lazy" class=" wp-image-70585" src="media/c823a822.spikes-heritage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/spikes-heritage.png" alt="" width="749" height="564" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/spikes-heritage.png 777w, https://krebsonsecurity.com/wp-content/uploads/2025/03/spikes-heritage-768x578.png 768w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70585" class="wp-caption-text">Branden and Natalia Spikes, on left, in 2011. The man on the far right is Ivan Y. Podvalov, a board member of the Kremlin-aligned Congress of Russian Americans (CRA). The man in the center is Feodor Yakimoff, director of operations at the Transib Global Sourcing Group, and chairman of the Russian Imperial Charity Balls, which works in concert with the Russian Heritage Foundation.</p></div>
<p>In 2011, the Spikes couple got divorced, and Natalia changed her last name to Haldeman. That is not her maiden name, which appears to be &#8220;Libina.&#8221; Rather, Natalia acquired the surname Haldeman in 1998, when she married Elon Musk&#8217;s cousin.</p>
<p><strong>Reeve Haldeman</strong> is the son of <strong>Scott Haldeman</strong>, who is the brother of Elon Musk&#8217;s mother, <strong>Maye Musk</strong>. Divorce records show Reeve and Natalia <a href="https://unicourt.com/case/ca-ora2-haldeman-v-haldeman-609208" target="_blank" rel="noopener">officially terminated</a> their marriage in 2007. Reeve Haldeman did not respond to a request for comment.<span id="more-70579"></span></p>
<p>A review of other domain names connected to Natalia Haldeman&#8217;s email address show she has registered more than a dozen domains over the years that are tied to the California Russian Association, and an apparently related entity called the <strong>Russian Heritage Foundation, Inc.</strong>:</p>
<p>russianamericans.org<br />
russianamericanstoday.com<br />
russianamericanstoday.org<br />
russiancalifornia.org<br />
russianheritagefoundation.com<br />
russianheritagefoundation.org<br />
russianwhitenights.com<br />
russianwhitenights.org<br />
theforafoundation.org<br />
thegoldentearoom.com<br />
therussianheritagefoundation.org<br />
tsarinahome.com</p>
<p>Ms. Haldeman did not respond to requests for comment. Her name and contact information appears in the registration records for these domains dating back to 2010, and <a href="https://projects.propublica.org/nonprofits/organizations/452775704 California Russian Foundation" target="_blank" rel="noopener">a document</a> published by <em>ProPublica</em> show that by 2016 Natalia Haldeman was appointed CEO of the California Russian Foundation.</p>
<p>The domain name that bears both Branden&#8217;s and Natalia&#8217;s names &#8212; orangeteamroom.com &#8212; features photos of Ms. Haldeman at fundraising events for the Russian foundation through 2014. Additional photos of her and many of the same people can be seen through 2023 at another domain she registered in 2010 &#8212; <strong>russianheritagefoundation.com</strong>.</p>
<div id="attachment_70630" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70630" decoding="async" loading="lazy" class=" wp-image-70630" src="media/086af0b6.haldeman-mayemusk-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/haldeman-mayemusk-1.png" alt="" width="750" height="429" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/haldeman-mayemusk-1.png 1258w, https://krebsonsecurity.com/wp-content/uploads/2025/03/haldeman-mayemusk-1-768x439.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/haldeman-mayemusk-1-782x447.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70630" class="wp-caption-text">A photo from Natalia Haldeman&#8217;s Facebook page shows her mother (left) pictured with Maye Musk, Elon Musk&#8217;s mother, in 2022.</p></div>
<p>The photo of Branden and Natalia above is from one such event in 2011 (tied to russianwhitenights.org, another Haldeman domain). The person on the right in that image &#8212; <strong>Ivan Y. Podvalov</strong> &#8212; appears in many fundraising event photos published by the foundation over the past decade. Podvalov is a board member of the <strong>Congress of Russian Americans</strong> (CRA), a nonprofit group that is known for vehemently opposing U.S. financial and legal sanctions against Russia.</p>
<p>Writing for <em>The Insider</em> in 2022, journalist <strong>Diana Fishman</strong> described how the CRA has engaged in outright political lobbying, noting that the organization in June 2014 sent a letter to President Obama and the secretary of the United Nations, calling for an end to the &#8220;large-scale US intervention in Ukraine and the campaign to isolate Russia.&#8221;</p>
<p>&#8220;The US military contingents must be withdrawn immediately from the Eastern European region, and NATO&#8217;s enlargement efforts and provocative actions against Russia must cease,” the message read.</p>
<p>The Insider said the CRA director sent another two letters, this time to President Donald Trump, in 2017 and 2018.</p>
<p>&#8220;One was a request not to sign a law expanding sanctions against Russia,&#8221; Fishman <a href="https://theins.ru/en/politics/256825" target="_blank" rel="noopener">wrote</a>. &#8220;The other regretted the expulsion of 60 Russian diplomats from the United States and urged not to jump to conclusions on Moscow&#8217;s involvement in the poisoning of Sergei Skripal.&#8221;</p>
<p>The nonprofit tracking website CauseIQ.com <a href="https://www.causeiq.com/organizations/russian-heritage-foundation,831537424/" target="_blank" rel="noopener">reports</a> that The Russian Heritage Foundation, Inc. is now known as <strong>Constellation of Humanity</strong>.</p>
<p>The Russian Heritage Foundation and the California Russian Association both promote the interests of <a href="https://cepa.org/article/an-unorthodox-russian-vision-of-heaven-and-hell/" target="_blank" rel="noopener">the Russian Orthodox Church</a>. <a href="https://web.archive.org/web/20141119232054/http://www.russiancalifornia.org/russian-orthodox-church-orange-county/" target="_blank" rel="noopener">This page</a> indexed by Archive.org from russiancalifornia.org shows The California Russian Foundation organized a community effort to establish an Orthodox church in Orange County, Calif.</p>
<p>A press release from the <strong>Russian Orthodox Church Outside of Russia</strong> (ROCOR) shows that in 2021 the Russian Heritage Foundation <a href="https://www.rocorstudies.org/2021/03/09/russian-heritage-foundation-supports-our-work/" target="_blank" rel="noopener">donated money</a> to organize a conference for the Russian Orthodox Church in Serbia.</p>
<p>A review of the &#8220;<a href="https://orangetearoom.com/index.php/network/about-us" target="_blank" rel="noopener">Partners</a>&#8221; listed on the Spikes&#8217; jointly registered domain &#8212; orangetearoom.com &#8212; shows the organization worked with a marketing company called <strong>Russian American Media</strong>. <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">Reporting by KrebsOnSecurity last year</a> showed that Russian American Media also partners with the problematic people-search service <strong>Radaris</strong>, which was formed by two native Russian brothers in Massachusetts who have built a fleet of consumer data brokers and Russian affiliate programs.</p>
<p>When asked about his ex-wife&#8217;s history, Spikes said she has a good heart and bears no ill-will toward anyone.</p>
<p>&#8220;I attended several of Natalia&#8217;s social events over the years we were together and can assure you that she&#8217;s got the best intentions with those,&#8221; Spikes told KrebsOnSecurity. &#8220;There&#8217;s no funny business going on. It is just a way for those friendly immigrants to find resources amongst each other to help get settled in and chase the American dream. I mean, they&#8217;re not unlike the immigrants from other countries who come to America and try to find each other and help each other find others who speak the language and share in the building of their businesses here in America.&#8221;</p>
<p>Spikes said his own family roots go back deeply into American history, sharing that his 6th great grandfather was Alexander Hamilton on his mom&#8217;s side, and Jessie James on his dad&#8217;s side.</p>
<p>&#8220;My family roots are about as American as you can get,&#8221; he said. &#8220;I&#8217;ve also been entrusted with building and safeguarding Elon&#8217;s companies since 1999 and have a keen eye (as you do) for bad actors, so have enough perspective to tell you that Natalia has no bad blood and that she loves America.&#8221;</p>
<p>Of course, this perspective comes from someone who has the utmost regard for the interests of the &#8220;special government employee&#8221; Mr. Musk, who has been bragging about tossing entire federal agencies into the &#8220;wood chipper,&#8221; and who recently <a href="https://apnews.com/article/musk-chainsaw-trump-doge-6568e9e0cfc42ad6cdcfd58a409eb312" target="_blank" rel="noopener">wielded an actual chainsaw</a> on stage while referring to it as the &#8220;chainsaw for bureaucracy.&#8221;</p>
<p>&#8220;Elon&#8217;s intentions are good and you can trust him,&#8221; Spikes assured.</p>
<p>A special note of thanks for research assistance goes to <strong>Jacqueline Sweet</strong>, an independent investigative journalist whose work has been published in The Guardian, Rolling Stone, POLITICO and The Intercept.</p>


