# articles

feed_id: https://krebsonsecurity.com/?p=65335
title: Tech CEO Sentenced to 5 Years in IP Address Scheme
uri: Tech-CEO-Sentenced-to-5-Years-in-IP-Address-Scheme
url: https://krebsonsecurity.com/2023/10/tech-ceo-sentenced-to-5-years-in-ip-address-scheme/
content:
<p><strong>Amir Golestan</strong>, the 40-year-old CEO of the Charleston, S.C. based technology company <strong>Micfo LLC</strong>, has been sentenced to five years in prison for wire fraud. Golestan&#8217;s sentencing comes nearly two years after he pleaded guilty to using an elaborate network of phony companies to secure more than 735,000 Internet Protocol (IP) addresses from the <strong>American Registry for Internet Numbers</strong> (ARIN), the nonprofit which oversees IP addresses assigned to entities in the U.S., Canada, and parts of the Caribbean.</p>
<div id="attachment_48758" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-48758" decoding="async" class=" wp-image-48758" src="media/b7b0003e.amirgolestan-image.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/amirgolestan-image.png" alt="" width="749" height="476" /><p id="caption-attachment-48758" class="wp-caption-text">Amir Golestan, the former CEO of Micfo.</p></div>
<p>In 2018, ARIN sued Golestan and Micfo, alleging they had obtained hundreds of thousands of IP addresses under false pretenses. ARIN and Micfo settled that dispute in arbitration, with Micfo returning most of the addresses that it hadn’t already sold.</p>
<p>ARIN&#8217;s civil case caught the attention of federal prosecutors in South Carolina, who in May 2019 <a href="https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address-scammers/" target="_blank" rel="noopener">filed criminal wire fraud charges against Golestan</a>, alleging he’d orchestrated a network of shell companies and fake identities to prevent ARIN from knowing the addresses were all going to the same buyer.</p>
<p>Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, the government was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN.</p>
<p>Golestan initially sought to fight those charges. But on just the second day of his trial in November 2021, Golestan changed his mind and <a href="https://krebsonsecurity.com/2021/11/tech-ceo-pleads-to-wire-fraud-in-ip-address-scheme/" target="_blank" rel="noopener">pleaded guilty to 20 counts of wire fraud</a> in connection with the phantom companies he used to secure the IP addresses. Prosecutors estimated those addresses were valued at between $10 million and $14 million.<span id="more-65335"></span></p>
<p>ARIN says the 5-year sentence handed down by the South Carolina judge &#8220;sends an important message of deterrence to other parties contemplating fraudulent schemes to obtain or transfer Internet resources.&#8221;</p>
<p>&#8220;Those who seek to defraud ARIN (or other Regional Internet Registries) are subject to costly and serious civil litigation, criminal charges, and, ultimately, a lengthy term of incarceration,&#8221; reads <a href="https://www.arin.net/blog/2023/10/16/micfo-golestan-sentencing/" target="_blank" rel="noopener">a statement</a> from ARIN on Golestan&#8217;s sentencing.</p>
<p>By 2013, a number of Micfo’s customers had landed on the radar of <a href="https://www.spamhaus.org" target="_blank" rel="noopener">Spamhaus</a>, a group that many network operators rely upon to stem the tide of junk email. Shortly after Spamhaus started blocking Micfo’s IP address ranges, Micfo shifted gears and began reselling IP addresses mainly to companies marketing “virtual private networking” or VPN services that help customers hide their real IP addresses online.</p>
<p>Golestan did not respond to a request for comment. But in a 2020 interview with KrebsOnSecurity, Golestan claimed that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers. Throughout that conversation, Golestan maintained his innocence, even as he explained that the creation of the phony companies was necessary to prevent entities like Spamhaus from interfering with his business going forward.</p>
<p>There are fewer than four billion so-called “Internet Protocol version 4” or IPv4 addresses available for use, but the vast majority of them have already been allocated. The global dearth of available IP addresses has turned them into a commodity wherein each IPv4 address can fetch between $15-$25 on the open market.</p>
<p>This has led to boom times for those engaged in the acquisition and sale of IP address blocks, but it has likewise emboldened those who specialize in <a href="https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/" target="_blank" rel="noopener">absconding with</a> and <a href="https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/" target="_blank" rel="noopener">spamming from dormant IP address blocks</a> without permission from the rightful owners.</p>
<p>The U.S Department of Justice says Golestan will serve 60 months in prison, followed by a 2-year term of court-ordered supervision. The Micfo CEO also was ordered to pay nearly $77,000 in restitution to ARIN for its work in assisting federal prosecutors.</p>


feed_id: https://krebsonsecurity.com/?p=65327
title: The Fake Browser Update Scam Gets a Makeover
uri: The-Fake-Browser-Update-Scam-Gets-a-Makeover
url: https://krebsonsecurity.com/2023/10/the-fake-browser-update-scam-gets-a-makeover/
content:
<p>One of the oldest malware tricks in the book &#8212; hacked websites claiming visitors need to update their Web browser before they can view any content &#8212; has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain.</p>
<p><img decoding="async" class="aligncenter wp-image-65369" src="media/9c408674.fakechromeupdate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/fakechromeupdate.png" alt="an image of a warning that the Chrome browser needs to be updated, showing several devices (phone, monitor, etc.) open to Google and an enticing blue button to click in the middle." width="749" height="478" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/fakechromeupdate.png 785w, https://krebsonsecurity.com/wp-content/uploads/2023/10/fakechromeupdate-768x490.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/10/fakechromeupdate-782x499.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>In August 2023, security researcher <a href="https://infosec.exchange/@rmceoin" target="_blank" rel="noopener">Randy McEoin</a> blogged about a scam he dubbed <a href="https://rmceoin.github.io/malware-analysis/clearfake/" target="_blank" rel="noopener">ClearFake</a>, which uses hacked WordPress sites to serve visitors with a page that claims you need to update your browser before you can view the content.</p>
<p>The fake browser alerts are specific to the browser you&#8217;re using, so if you&#8217;re surfing the Web with Chrome, for example, you&#8217;ll get a Chrome update prompt. Those who are fooled into clicking the update button will have a malicious file dropped on their system that tries to install an information stealing trojan.</p>
<p>Earlier this month, researchers at the Tel Aviv-based security firm <strong>Guardio</strong> said they tracked an updated version of the ClearFake scam that included an important evolution. Previously, the group had stored its malicious update files on Cloudflare, Guardio said.</p>
<p>But when Cloudflare blocked those accounts the attackers began storing their malicious files as cryptocurrency transactions in the <strong>Binance Smart Chain</strong> (BSC), a technology designed to run decentralized apps and &#8220;smart contracts,&#8221; or coded agreements that execute actions automatically when certain conditions are met.</p>
<p><strong>Nati Tal</strong>, head of security at <strong>Guardio Labs</strong>, the research unit at Guardio, said the malicious scripts stitched into hacked WordPress sites will create a new smart contract on the BSC Blockchain, starting with a unique, attacker-controlled blockchain address and a set of instructions that defines the contract&#8217;s functions and structure. When that contract is queried by a compromised website, it will return an obfuscated and malicious payload.</p>
<p>&#8220;These contracts offer innovative ways to build applications and processes,&#8221; Tal <a href="https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16" target="_blank" rel="noopener">wrote</a> along with his Guardio colleague <strong>Oleg Zaytsev</strong>. &#8220;Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted &#8216;on-chain&#8217; without the ability for a takedown.&#8221;</p>
<p>Tal said hosting malicious files on the Binance Smart Chain is ideal for attackers because retrieving the malicious contract is a cost-free operation that was originally designed for the purpose of debugging contract execution issues without any real-world impact.</p>
<p>&#8220;So you get a free, untracked, and robust way to get your data (the malicious payload) without leaving traces,&#8221; Tal said.<span id="more-65327"></span></p>
<div id="attachment_65371" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65371" decoding="async" loading="lazy" class=" wp-image-65371" src="media/3d8ef7d1.fakebrowser-guardio.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/fakebrowser-guardio.png" alt="" width="748" height="814" /><p id="caption-attachment-65371" class="wp-caption-text">Attacker-controlled BSC addresses — from funding, contract creation, and ongoing code updates. Image: Guardio</p></div>
<p>In response to questions from KrebsOnSecurity, the <strong>BNB Smart Chain</strong> (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts.</p>
<p>&#8220;This model is designed to proactively identify and mitigate potential threats before they can cause harm,&#8221; BNB Smart Chain wrote. &#8220;The team is committed to ongoing monitoring of addresses that are involved in spreading malware scripts on the BSC. To enhance their efforts, the tech team is working on linking identified addresses that spread malicious scripts to centralized KYC [Know Your Customer] information, when possible.&#8221;</p>
<p>Guardio says the crooks behind the BSC malware scheme are using the same malicious code as the attackers that McEoin wrote about in August, and are likely the same group. But a report published today by email security firm <strong>Proofpoint</strong> says the company is currently tracking at least four distinct threat actor groups that use fake browser updates to distribute malware.</p>
<p>Proofpoint notes that the core group behind the fake browser update scheme has been using this technique to spread malware for the past five years, primarily because the approach still works well.</p>
<p>&#8220;Fake browser update lures are effective because threat actors are using an end-user&#8217;s security training against them,&#8221; Proofpoint&#8217;s <strong>Dusty Miller</strong> <a href="https://www.proofpoint.com/us/blog/threat-insight/are-you-sure-your-browser-date-current-landscape-fake-browser-updates" target="_blank" rel="noopener">wrote</a>. &#8220;In security awareness training, users are told to only accept updates or click on links from known and trusted sites, or individuals, and to verify sites are legitimate. The fake browser updates abuse this training because they compromise trusted sites and use JavaScript requests to quietly make checks in the background and overwrite the existing website with a browser update lure. To an end user, it still appears to be the same website they were intending to visit and is now asking them to update their browser.&#8221;</p>
<p>More than a decade ago, this site published <a href="https://krebsonsecurity.com/2011/05/krebss-3-basic-rules-for-online-safety/" target="_blank" rel="noopener">Krebs&#8217;s Three Rules for Online Safety</a>, of which Rule #1 was, &#8220;<em>If you didn&#8217;t go looking for it, don&#8217;t install it.</em>&#8221; It&#8217;s nice to know that this technology-agnostic approach to online safety remains just as relevant today.</p>


feed_id: https://krebsonsecurity.com/?p=65404
title: Hackers Stole Access Tokens from Okta’s Support Unit
uri: Hackers-Stole-Access-Tokens-from-Okta-s-Support-Unit
url: https://krebsonsecurity.com/2023/10/hackers-stole-access-tokens-from-oktas-support-unit/
content:
<p><strong>Okta</strong>, a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a &#8220;very small number&#8221; of customers, however it appears the hackers responsible had access to Okta&#8217;s support platform for at least two weeks before the company fully contained the intrusion.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-65407" src="media/9ed08d01.okta-ss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/okta-ss.png" alt="" width="672" height="426" /></p>
<p>In an advisory sent to an undisclosed number of customers on Oct. 19, Okta said it &#8220;has identified adversarial activity that leveraged access to a stolen credential to access Okta&#8217;s support case management system. The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases.&#8221;</p>
<p>Okta explained that when it is troubleshooting issues with customers it will often ask for a recording of a Web browser session (a.k.a. an HTTP Archive or <strong>HAR</strong> file). These are sensitive files because in this case they include the customer&#8217;s cookies and session tokens, which intruders can then use to impersonate valid users.</p>
<p>&#8220;Okta has worked with impacted customers to investigate, and has taken measures to protect our customers, including the revocation of embedded session tokens,&#8221; their notice continued. &#8220;In general, Okta recommends sanitizing all credentials and cookies/session tokens within a HAR file before sharing it.&#8221;</p>
<p>The security firm <strong>BeyondTrust</strong> is among the Okta customers who received Thursday&#8217;s alert from Okta. BeyondTrust Chief Technology Officer <strong>Marc Maiffret</strong> said that alert came more than two weeks after his company alerted Okta to a potential problem.</p>
<p>Maiffret emphasized that BeyondTrust caught the attack earlier this month as it was happening, and that none of its own customers were affected. He said that on Oct 2., BeyondTrust&#8217;s security team detected that someone was trying to use an Okta account assigned to one of their engineers to create an all-powerful administrator account within their Okta environment.</p>
<p>When BeyondTrust reviewed the activity of the employee account that tried to create the new administrative profile, they found that &#8212; just 30 minutes prior to the unauthorized activity &#8212; one of their support engineers shared with Okta one of these HAR files that contained a valid Okta session token, Maiffret said.</p>
<p>&#8220;Our admin sent that [HAR file] over at Okta&#8217;s request, and 30 minutes after that the attacker started doing session hijacking, tried to replay the browser session and leverage the cookie in that browser recording to act on behalf of that user,&#8221; he said.</p>
<p>Maiffret said BeyondTrust followed up with Okta on Oct. 3 and said they were fairly confident Okta had suffered an intrusion, and that he reiterated that conclusion in a phone call with Okta on October 11 and again on Oct. 13.</p>
<p>In an interview with KrebsOnSecurity, Okta&#8217;s Deputy Chief Information Security Officer <strong>Charlotte Wylie</strong> said Okta initially believed that BeyondTrust&#8217;s alert on Oct. 2 was not a result of a breach in its systems. But she said that by Oct. 17, the company had identified and contained the incident &#8212; disabling the compromised customer case management account, and invalidating Okta access tokens associated with that account.<span id="more-65404"></span></p>
<p>Wylie declined to say exactly how many customers received alerts of a potential security issue, but characterized it as a &#8220;very, very small subset&#8221; of its more than 18,000 customers.</p>
<p>The disclosure from Okta comes just weeks after casino giants <strong>Caesar&#8217;s Entertainment</strong> and <strong>MGM Resorts</strong> were hacked. In both cases, the attackers managed to social engineer employees into <a href="https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection/" target="_blank" rel="noopener">resetting the multi-factor login requirements for Okta administrator accounts</a>.</p>
<p>In March 2022, Okta disclosed a breach from the hacking group LAPSUS$, a criminal hacking group that specialized in social-engineering employees at targeted companies. An <a href="https://www.okta.com/blog/2022/04/okta-concludes-its-investigation-into-the-january-2022-compromise/" target="_blank" rel="noopener">after-action report from Okta</a> on that incident found that LAPSUS$ had social engineered its way onto the workstation of a support engineer at Sitel, a third-party outsourcing company that had access to Okta resources.</p>
<p>Okta&#8217;s Wylie declined to answer questions about how long the intruder may have had access to the company&#8217;s case management account, or who might have been responsible for the attack. However, she did say the company believes this is an adversary they have seen before.</p>
<p>&#8220;This is a known threat actor that we believe has targeted us and Okta-specific customers,&#8221; Wylie said.</p>
<p><strong>Update, 2:57 p.m. ET: </strong>Okta has published <a href="https://sec.okta.com/harfiles" target="_blank" rel="noopener">a blog post</a> about this incident that includes some &#8220;indicators of compromise&#8221; that customers can use to see if they were affected. But the company stressed that &#8220;all customers who were impacted by this have been notified. If you’re an Okta customer and you have not been contacted with another message or method, there is no impact to your Okta environment or your support tickets.&#8221;</p>
<p><strong>Update, 3:36 p.m. ET:</strong> BeyondTrust has <a href="https://www.beyondtrust.com/blog/entry/okta-support-unit-breach" target="_blank" rel="noopener">published a blog post</a> about their findings.</p>


feed_id: https://krebsonsecurity.com/?p=65392
title: NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison
uri: NJ-Man-Hired-Online-to-Firebomb-Shoot-at-Homes-Gets-13-Years-in-Priso
url:
https://krebsonsecurity.com/2023/10/nj-man-hired-online-to-firebomb-shoot-at-homes-gets-13-years-in-prison/

content:
<p>A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. <strong>Patrick McGovern-Allen</strong> was the subject of a Sept. 4, 2022 story here about the emergence of &#8220;violence-as-a-service&#8221; offerings, where random people from the Internet hire themselves out to perform a variety of local, physical attacks, including firebombing a home, &#8220;bricking&#8221; windows, slashing tires, or performing a drive-by shooting at someone&#8217;s residence.</p>
<p><img decoding="async" class="aligncenter wp-image-65400" src="media/e0d14806.briked.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/briked.png" alt="" width="749" height="485" /></p>
<p>McGovern-Allen, of Egg Harbor Township, N.J., was arrested Aug. 12, 2022 on an FBI warrant, which showed he was part of a group of cybercriminals who are settling scores with one another by hiring people to carry out violent attacks on their rivals.</p>
<p>That <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/">Sept. 2022 story</a> about his arrest included links to two videos released on Telegram that were recorded and shared by McGovern-Allen and/or a co-conspirator as “proof” that they had carried out the attacks as hired.</p>
<p>The first showed two young men tossing a Molotov Cocktail at the side of a residence in Abington Township, Pa, setting it ablaze. The second featured two men with handguns unloading multiple rounds haphazardly into the first story of a house in West Chester, Pa. Fortunately in both cases, the occupants of the homes were unharmed in the attacks.</p>
<p>Federal prosecutors said McGovern-Allen went by the alias &#8220;Tongue&#8221; on Discord, and that in one chat he was quite explicit about his violence-as-a-service offering.</p>
<p>“In the chats, [Tongue] tells other Discord users that he was the person who shot K.M.’s house and that he was willing to commit firebombings using Molotov Cocktails,” the complaint against McGovern-Allen explains. “For example, in one Discord chat from March 2022, [the defendant] states ‘if you need anything done for $ lmk [“let me know”]/I did a shooting/Molotov/but I can also do things for ur entertainment.”</p>
<p>The chat channels that Tongue frequented have hundreds to thousands of members each, and some of the more interesting solicitations on these communities are job offers for in-person assignments and tasks that can be found if one searches for posts titled, “If you live near,” or “IRL job” — short for “in real life” job. A number of these classified ads are in service of performing “brickings,” where someone is hired to visit a specific address and toss a brick through the target’s window.</p>
<p>McGovern-Allen was in the news not long ago. According to <a href="https://pressofatlanticcity.com/news/crime/egg-harbor-township-man-injured-after-driving-into-pleasantville-building/article_aebb289d-940c-573e-ada3-7c4ec9768d0d.html" target="_blank" rel="noopener">a Sept. 2020 story</a> from <em>The Press of Atlantic City</em>, a then 19-year-old Patrick McGovern-Allen was injured after driving into a building and forcing residents from their home.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-61157" src="media/7fc5897a.ma-housecrash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/ma-housecrash.png" alt="" width="686" height="633" /></p>
<p>“Police found a 2007 Lexus, driven by Patrick McGovern-Allen, 19, that had lost control and left the road, crashing into the eastern end of the 1600 building,” the story recounted. “The car was driven through the steps that provide access to the second-floor apartments, destroying them, and also caused damage to the outer wall.”</p>
<p>A copy of McGovern-Allen&#8217;s sentencing statement says he pleaded guilty to three criminal counts, including two for stalking, and one for the use of fire in commission of a federal felony. The judge in the case gave McGovern-Allen 160 months in prison &#8212; about 13.3 years. After completing his sentence, McGovern-Allen will be on supervised release for three years.</p>


feed_id: https://krebsonsecurity.com/?p=65446
title: .US Harbors Prolific Malicious Link Shortening Service
uri: US-Harbors-Prolific-Malicious-Link-Shortening-Service
url: https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shortening-service/
content:
<p>The top-level domain for the United States &#8212; <strong>.US</strong> &#8212; is home to thousands of newly-registered domains tied to a malicious link shortening service that facilitates malware and phishing scams, new research suggests. The findings come close on the heels of a report that identified .US domains as among the most prevalent in phishing attacks over the past year.</p>
<p>Researchers at <strong>Infoblox</strong> say they&#8217;ve been tracking what appears to be a three-year-old link shortening service that is catering to phishers and malware purveyors. Infoblox found the domains involved are typically three to seven characters long, and hosted on bulletproof hosting providers that charge a premium to ignore any abuse or legal complaints. The short domains don&#8217;t host any content themselves, but are used to obfuscate the real address of landing pages that try to phish users or install malware.</p>
<div id="attachment_65459" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65459" decoding="async" class=" wp-image-65459" src="media/4fdfa003.ppuma.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/ppuma.png" alt="" width="750" height="514" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/ppuma.png 892w, https://krebsonsecurity.com/wp-content/uploads/2023/10/ppuma-768x526.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/10/ppuma-782x536.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/10/ppuma-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-65459" class="wp-caption-text">A graphic describing the operations of a malicious link shortening service that Infoblox has dubbed &#8220;Prolific Puma.&#8221;</p></div>
<p>Infoblox says it&#8217;s unclear how the phishing and malware landing pages tied to this service are being initially promoted, although they suspect it is mainly through scams targeting people on their phones via SMS. A new report says the company mapped the contours of this link shortening service thanks in part to pseudo-random patterns in the short domains, which all appear on the surface to be a meaningless jumble of letters and numbers.</p>
<p>&#8220;This came to our attention because we have systems that detect registrations that use domain name generation algorithms,&#8221; said <strong>Renee Burton</strong>, head of threat intelligence at Infoblox. &#8220;We have not found any legitimate content served through their shorteners.&#8221;</p>
<p>Infoblox determined that until May 2023, domains ending in .info accounted for the bulk of new registrations tied to the malicious link shortening service, which Infoblox has dubbed &#8220;<strong>Prolific Puma</strong>.&#8221; Since then, they found that whoever is responsible for running the service has used .US for approximately 55 percent of the total domains created, with several dozen new malicious .US domains registered daily.</p>
<p>.US is overseen by the <strong>National Telecommunications and Information Administration</strong> (NTIA), an executive branch agency of the <strong>U.S. Department of Commerce</strong>. But Uncle Sam has long outsourced the management of .US to various private companies, which have gradually allowed the United States&#8217;s top-level domain to devolve into a cesspool of phishing activity.</p>
<p>Or so concludes <strong>The Interisle Consulting Group</strong>, which gathers phishing data from multiple industry sources and publishes an annual report on the latest trends. As far back as 2018, Interisle found .US domains were the worst in the world for spam, botnet (attack infrastructure for DDOS etc.) and illicit or harmful content.</p>
<p>Interisle’s <a href="https://krebsonsecurity.com/2023/09/why-is-us-being-used-to-phish-so-many-of-us/" target="_blank" rel="noopener">newest study</a> examined six million phishing reports between May 1, 2022 and April 30, 2023, and identified approximately 30,000 .US phishing domains. Interisle found significant numbers of .US domains were registered to attack some of the United States’ most prominent companies, including Bank of America, Amazon, Apple, AT&amp;T, Citi, Comcast, Microsoft, Meta, and Target. Others were used to impersonate or attack U.S. government agencies.</p>
<p>Under NTIA regulations, domain registrars processing .US domain registrations must take <a href="media/1acd1ac5.ustld2007_34_apph_nexus.pdf" data-original-source="https://www.ntia.doc.gov/files/ntia/publications/ustld2007_34_apph_nexus.pdf" target="_blank" rel="noopener">certain steps</a> (PDF) to verify that those customers actually reside in the United States, or else own organizations based in the U.S. However, if one registers a .US domain through GoDaddy &#8212; the largest domain registrar and the current administrator of the .US contract &#8212; the way one &#8220;proves&#8221; their U.S. nexus is simply by choosing from one of three pre-selected affirmative responses.</p>
<p>In an age when most domain registrars are automatically redacting customer information from publicly accessible registration records to avoid running afoul of European privacy laws, .US has remained something of an outlier because its charter specifies that all registration records be made public. However, Infoblox said it found more than 2,000 malicious link shortener domains ending in .US registered since October 2023 through <strong>NameSilo</strong> that have somehow subverted the transparency requirements for the usTLD and converted to private registrations.</p>
<p>&#8220;Through our own experience with NameSilo, it is not possible to select private registration for domains in the usTLD through their interface,&#8221; Infoblox wrote. &#8220;And yet, it was done. Of the total domains with private records, over 99% were registered with NameSilo. At this time, we are not able to explain this behavior.&#8221;</p>
<p>NameSilo CEO <strong>Kristaps Ronka</strong> said the company actively responds to reports about abusive domains, but that it hasn&#8217;t seen any abuse reports related to Infoblox&#8217;s findings.</p>
<p>&#8220;We take down hundreds to thousands of domains, lots of them proactively to combat abuse,&#8221; Ronka said. &#8220;Our current abuse rate on abuseIQ for example is currently at 0%. AbuseIQ receives reports from countless sources and we are yet to see these &#8216;Puma&#8217; abuse reports.&#8221;</p>
<p><span id="more-65446"></span></p>
<p>Experts who track domains associated with malware and phishing say even phony information supplied at registration is useful in identifying potentially malicious or phishous domains before they can be used for abuse.</p>
<p>For example, when it was registered through NameSilo in July 2023, the domain <strong>1ox[.]us</strong> &#8212; like thousands of others &#8212; listed its registrant as &#8220;<strong>Leila Puma</strong>&#8221; at a street address in Poland, and the email address <strong>blackpumaoct33@ukr.net</strong>. But according to <strong>DomainTools.com</strong>, on Oct. 1, 2023 those records were redacted and hidden by NameSilo.</p>
<p>Infoblox notes that the username portion of the email address appears to be a reference to the song October 33 by the <a href="https://www.blackpumas.com/" target="_blank" rel="noopener">Black Pumas</a>, an Austin, Texas based psychedelic soul band. The Black Pumas aren&#8217;t exactly a household name, but they did recently have <a href="https://www.youtube.com/watch?v=D_Ap_7wjHls" target="_blank" rel="noopener">a popular Youtube video</a> that featured a cover of the Kinks song &#8220;Strangers,&#8221; which included an emotional visual narrative about Ukrainians seeking refuge from the Russian invasion, titled &#8220;Ukraine Strangers.&#8221; Also, Leila Puma&#8217;s email address is at a Ukrainian email provider.</p>
<p>DomainTools shows that hundreds of other malicious domains tied to Prolific Puma previously were registered through <strong>NameCheap</strong> to a &#8220;Josef Bakhovsky&#8221; at a different street address in Poland. According to <a href="https://www.ancestry.com/name-origin?surname=bakowski#:~:text=Bakowski%20Family%20History-,Bakowski%20Name%20Meaning,Compare%20Bonkowski%20." target="_blank" rel="noopener">ancestry.com</a>, the anglicized version of this surname &#8212; Bakovski &#8212; is the traditional name for someone from Bakowce, which is now known as Bakivtsi and is in Ukraine.</p>
<p>This possible Polish and/or Ukrainian connection may or may not tell us something about the &#8220;who&#8221; behind this link shortening service, but those details are useful for identifying and grouping these malicious short domains. However, even this meager visibility into .US registration data is now under threat.</p>
<p>The NTIA <a href="https://www.federalregister.gov/documents/2023/05/01/2023-09180/introduction-of-accountable-measures-regarding-access-to-personal-information-of-us-registrants" target="_blank" rel="noopener">recently published a proposal</a> that would allow registrars to redact all registrant data from WHOIS registration records for .US domains. A broad array of industry groups have <a href="https://www.regulations.gov/docket/NTIA-2023-0006/comments" target="_blank" rel="noopener">filed comments opposing the proposed changes</a>, saying they threaten to remove the last vestiges of accountability for a top-level domain that is already overrun with cybercrime activity.</p>
<p>Infoblox&#8217;s Burton says Prolific Puma is remarkable because they&#8217;ve been able to facilitate malicious activities for years while going largely unnoticed by the security industry.</p>
<p>&#8220;This exposes how persistent the criminal economy can be at a supply chain level,&#8221; Burton said. &#8220;We&#8217;re always looking at the end malware or phishing page, but what we&#8217;re finding here is that there&#8217;s this middle layer of DNS threat actors persisting for years without notice.&#8221;</p>
<p>Infoblox&#8217;s full report on Prolific Puma is <a href="https://blogs.infoblox.com/cyber-threat-intelligence/prolific-puma-shadowy-link-shortening-service-enables-cybercrime/" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=65479
title: Russian Reshipping Service ‘SWAT USA Drop’ Exposed
uri: Russian-Reshipping-Service-SWAT-USA-Drop-Exposed
url: https://krebsonsecurity.com/2023/11/russian-reshipping-service-swat-usa-drop-exposed/
content:
<div id="attachment_65495" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65495" decoding="async" class=" wp-image-65495" src="media/5e19d166.swatship-login.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-login.png" alt="" width="749" height="570" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-login.png 877w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-login-768x584.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-login-782x595.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-65495" class="wp-caption-text">The login page for the criminal reshipping service SWAT USA Drop.</p></div>
<p>One of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. Here&#8217;s a closer look at the Russia-based <strong>SWAT USA Drop Service</strong>, which currently employs more than 1,200 people across the United States who are knowingly or unwittingly involved in reshipping expensive consumer goods purchased with stolen credit cards.</p>
<p>Among the most common ways that thieves extract cash from stolen credit card accounts is through purchasing pricey consumer goods online and reselling them on the black market. Most online retailers grew wise to these scams years ago and stopped shipping to regions of the world most frequently associated with credit card fraud, including Eastern Europe, North Africa, and Russia.</p>
<p>But such restrictions have created a burgeoning underground market for reshipping scams, which rely on willing or unwitting residents in the United States and Europe to receive stolen goods and relay them to crooks living in the embargoed areas.</p>
<p>Services like SWAT are known as “Drops for stuff” on cybercrime forums. The “<strong>drops</strong>” are people who have responded to work-at-home package reshipping jobs advertised on craigslist.com and job search sites. Most reshipping scams promise employees a monthly salary and even cash bonuses. In reality, the crooks in charge almost always stop communicating with drops just before the first payday, usually about a month after the drop ships their first package.</p>
<p>The packages arrive with prepaid shipping labels that are paid for with stolen credit card numbers, or with <a href="https://krebsonsecurity.com/2014/08/white-label-money-laundering-services/" target="_blank" rel="noopener">hijacked online accounts at FedEx and the US Postal Service</a>. Drops are responsible for inspecting and verifying the contents of shipments, attaching the correct shipping label to each package, and sending them off via the appropriate shipping company.</p>
<p>SWAT takes a percentage cut (up to 50 percent) where &#8220;<strong>stuffers</strong>&#8221; &#8212; thieves armed with stolen credit card numbers &#8212; pay a portion of each product’s retail value to SWAT as the reshipping fee. The stuffers use stolen cards to purchase high-value products from merchants and have the merchants ship the items to the drops’ address. Once the drops receive and successfully reship the stolen packages, the stuffers then sell the products on the local black market.</p>
<p>The SWAT drop service has been around in various names and under different ownership for almost a decade. But in early October 2023, SWAT&#8217;s current co-owner &#8212; a Russian-speaking individual who uses the handle &#8220;<strong>Fearlless</strong>&#8221; &#8212; took to his favorite cybercrime forum to lodge a formal complaint against the owner of a competing reshipping service, alleging his rival had hacked SWAT and was trying to poach his stuffers and reshippers by emailing them directly.<span id="more-65479"></span></p>
<p>Milwaukee-based security firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> shared recent screenshots of a working SWAT stuffer&#8217;s user panel, and those images show that SWAT currently lists more than 1,200 drops in the United States that are available for stuffers to rent. The contact information for <strong>Kareem</strong>, a young man from Maryland, was listed as an active drop. Contacted by KrebsOnSecurity, Kareem agreed to speak on condition that his full name not be used in this story.</p>
<div id="attachment_65513" style="width: 759px" class="wp-caption aligncenter"><a href="media/b856f9de.swatship-rule.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65513" decoding="async" loading="lazy" class="wp-image-65513" src="media/b856f9de.swatship-rule.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule.png" alt="" width="749" height="389" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule.png 1654w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule-768x398.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule-1536x797.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule-782x406.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatship-rule-267x140.png 267w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-65513" class="wp-caption-text">A SWAT panel for stuffers/customers. This page lists the rules of the service, which do not reimburse stuffers for “acts of god,” i.e. authorities seizing stolen goods or arresting the drop.</p></div>
<p>Kareem said he&#8217;d been hired via an online job board to reship packages on behalf of a company calling itself <strong>CTSI</strong>, and that he&#8217;s been receiving and reshipping iPads and Apple watches for several weeks now. Kareem was less than thrilled to learn he would probably not be getting his salary on the promised payday, which was coming up in a few days.</p>
<p>Kareem said he was instructed to create an account at a website called <strong>portal-ctsi[.]com</strong>, where each day he was expected to log in and check for new messages about pending shipments. Anyone can sign up at this website as a potential reshipping mule, although doing so requires applicants to share a great deal of personal and financial information, as well as copies of an ID or passport matching the supplied name.</p>
<div id="attachment_65497" style="width: 760px" class="wp-caption aligncenter"><a href="media/6418a025.swatdropspanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatdropspanel.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65497" decoding="async" loading="lazy" class="wp-image-65497 " src="media/6418a025.swatdropspanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatdropspanel.png" alt="" width="750" height="488" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/11/swatdropspanel.png 1129w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatdropspanel-768x500.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/11/swatdropspanel-782x509.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-65497" class="wp-caption-text">A SWAT panel for stuffers/customers, listing hundreds of drops in the United States by their status. &#8220;Going to die&#8221; are those who are about to be let go without promised payment, or who have quit on their own.</p></div>
<p>On a suspicion that the login page for portal-ctsi[.]com might be a custom coding job, KrebsOnSecurity selected &#8220;view source&#8221; from the homepage to expose the site&#8217;s HTML code. Grabbing a snippet of that code (e.g., &#8220;smarty/default/jui/js/jquery-ui-1.9.2.min.js&#8221;) and searching on it at <strong>publicwww.com</strong> reveals more than four dozen other websites running the same login panel. And all of those appear to be geared toward either stuffers or drops. </p>
<p>In fact, more than half of the domains that use this same login panel actually include the word &#8220;stuffer&#8221; in the login URL, according to publicwww. Each of the domains below that end in &#8220;/user/login.php&#8221; are sites for active and prospective drops, and each corresponds to a unique fake company that is responsible for managing its own stable of drops:</p>
<p>lvlup-store[.]com/stuffer/login.php<br />
personalsp[.]com/user/login.php<br />
destaf[.]com/stuffer/login.php<br />
jaderaplus[.]com/stuffer/login.php<br />
33cow[.]com/stuffer/login.php<br />
panelka[.]net/stuffer/login.php<br />
aaservice[.]net/stuffer/login.php<br />
re-shipping[.]ru/stuffer/login.php<br />
bashar[.]cc/stuffer/login.php<br />
marketingyoursmall[.]biz/stuffer/login.php<br />
hovard[.]xyz/stuffer/login.php<br />
pullback[.]xyz/stuffer/login.php<br />
telollevoexpress[.]com/stuffer/login.php<br />
postme[.]today/stuffer/login.php<br />
wint-job[.]com/stuffer/login.php<br />
squadup[.]club/stuffer/login.php<br />
mmmpack[.]pro/stuffer/login.php<br />
yoursmartpanel[.]com/user/login.php<br />
opt257[.]org/user/login.php<br />
touchpad[.]online/stuffer/login.php<br />
peresyloff[.]top/stuffer/login.php<br />
ruzke[.]vodka/stuffer/login.php<br />
staf-manager[.]net/stuffer/login.php<br />
data-job[.]club/stuffer/login.php<br />
logistics-services[.]org/user/login.php<br />
swatship[.]club/stuffer/login.php<br />
logistikmanager[.]online/user/login.php<br />
endorphine[.]world/stuffer/login.php<br />
burbon[.]club/stuffer/login.php<br />
bigdropproject[.]com/stuffer/login.php<br />
jobspaket[.]net/user/login.php<br />
yourcontrolboard[.]com/stuffer/login.php<br />
packmania[.]online/stuffer/login.php<br />
shopping-bro[.]com/stuffer/login.php<br />
dash-redtag[.]com/user/login.php<br />
mnger[.]net/stuffer/login.php<br />
begg[.]work/stuffer/login.php<br />
dashboard-lime[.]com/user/login.php<br />
control-logistic[.]xyz/user/login.php<br />
povetru[.]biz/stuffer/login.php<br />
dash-nitrologistics[.]com/user/login.php<br />
cbpanel[.]top/stuffer/login.php<br />
hrparidise[.]pro/stuffer/login.php<br />
d-cctv[.]top/user/login.php<br />
versandproject[.]com/user/login.php<br />
packitdash[.]com/user/login.php<br />
avissanti-dash[.]com/user/login.php<br />
e-host[.]life/user/login.php<br />
pacmania[.]club/stuffer/login.php</p>
<p>Why so many websites? In practice, all drops are cut loose within approximately 30 days of their first shipment — just before the promised paycheck is due. Because of this constant churn, each stuff shop operator must be constantly recruiting new drops. Also, with this distributed setup, even if one reshipping operation gets shut down (or exposed online), the rest can keep on pumping out dozens of packages a day.</p>
<p>A <a href="media/c1cc2e8b.ccsfp155-haoA.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/09/ccsfp155-haoA.pdf" target="_blank" rel="noopener">2015 academic study</a> (PDF) on criminal reshipping services found the average financial hit from a reshipping scheme per cardholder was $1,156.93. That study looked into the financial operations of several reshipping schemes, and estimated that approximately 1.6 million credit and debit cards are used to commit at least $1.8 billion in reshipping fraud each year.</p>
<p>It&#8217;s not hard to see how reshipping can be a profitable enterprise for card crooks. For example, a stuffer buys a stolen payment card off the black market for $10, and uses that card to purchase more than $1,100 worth of goods. After the reshipping service takes its cut (~$550), and the stuffer pays for his reshipping label (~$100), the stuffer receives the stolen goods and sells them on the black market in Russia for $1,400. He has just turned a $10 investment into more than $700. Rinse, wash, and repeat.</p>
<p>The breach at SWAT exposed not only the nicknames and contact information for all of its stuffers and drops, but also the group&#8217;s monthly earnings and payouts. SWAT apparently kept its books in a publicly accessible Google Sheets document, and that document reveals Fearlless and his business partner each routinely made more than $100,000 every month operating their various reshipping businesses.</p>
<p>The exposed SWAT financial records show this crime group has tens of thousands of dollars worth of expenses each month, including payments for the following recurring costs:</p>
<p>-advertising the service on crime forums and via spam;<br />
-people hired to re-route packages, usually by voice over the phone;<br />
-third-party services that sell hacked/stolen USPS/Fedex labels;<br />
-&#8220;drops test&#8221; services, contractors who will test the honesty of drops by sending them fake jewelry;<br />
-&#8220;documents,&#8221; e.g. sending drops to physically pick up legal documents for new phony front companies.</p>
<p>The spreadsheet also included the cryptocurrency account numbers that were to be credited each month with SWAT&#8217;s earnings. Unsurprisingly, a review of the blockchain activity tied to the bitcoin addresses listed in that document shows that many of them have a deep association with cybercrime, including ransomware activity and transactions at darknet sites that peddle stolen credit cards and <a href="https://krebsonsecurity.com/tag/residential-proxies/" target="_blank" rel="noopener">residential proxy services</a>.</p>
<p>The information leaked from SWAT also has exposed the real-life identity and financial dealings of its principal owner &#8212; Fearlless, a.k.a. &#8220;SwatVerified.&#8221; We&#8217;ll hear more about Fearlless in Part II of this story. Stay tuned.</p>


feed_id: https://krebsonsecurity.com/?p=65541
title: Who’s Behind the SWAT USA Reshipping Service?
uri: Who-s-Behind-the-SWAT-USA-Reshipping-Service
url: https://krebsonsecurity.com/2023/11/whos-behind-the-swat-usa-reshipping-service/
content:
<p>Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today&#8217;s Part II, we&#8217;ll examine clues about the real-life identity of &#8220;<strong>Fearlless</strong>,&#8221; the nickname chosen by the proprietor of the <strong>SWAT USA Drops</strong> service.</p>
<p><img decoding="async" class="aligncenter wp-image-58061" src="media/f572f658.wbrkb.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wbrkb.jpg" alt="" width="750" height="501" /></p>
<p>Based in Russia, SWAT USA recruits people in the United States to reship packages containing pricey electronics that are purchased with stolen credit cards. As detailed in <a href="https://krebsonsecurity.com/2023/11/russian-reshipping-service-swat-usa-drop-exposed/" target="_blank" rel="noopener">this Nov. 2 story</a>, SWAT currently employs more than 1,200 U.S. residents, all of whom will be cut loose without a promised payday at the end of their first month reshipping stolen goods.</p>
<p>The current co-owner of SWAT, a cybercriminal who uses the nickname &#8220;Fearlless,&#8221; operates primarily on the cybercrime forum <strong>Verified</strong>. This Russian-language forum has tens of thousands of members, and it has suffered several hacks that exposed more than a decade&#8217;s worth of user data and direct messages.</p>
<p>January 2021 posts on Verified show that Fearlless and his partner <strong>Universalo</strong> purchased the SWAT reshipping business from a Verified member named SWAT, who&#8217;d been operating the service for years. SWAT agreed to transfer the business in exchange for 30 percent of the net profit over the ensuing six months.</p>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> says Fearlless first registered on Verified in February 2013. The email address Fearlless used on Verified leads nowhere, but a review of Fearlless&#8217; direct messages on Verified indicates this user originally registered on Verified a year earlier as a reshipping vendor, under the alias &#8220;<strong>Apathyp</strong>.&#8221;</p>
<p>There are two clues supporting the conclusion that Apathyp and Fearlless are the same person. First, the Verified administrators warned Apathyp he had violated the forum&#8217;s rules barring the use of multiple accounts by the same person, and that Verified&#8217;s automated systems had detected that Apathyp and Fearlless were logging in from the same device.  Second, in his earliest private messages on Verified, Fearlless told others to contact him on an instant messenger address that Apathyp had claimed as his.<span id="more-65541"></span></p>
<p>Intel 471 says Apathyp registered on Verified using the email address <strong>triploo@mail.ru</strong>. A search on that email address at the breach intelligence service <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> found that a password commonly associated with it was &#8220;<strong>niceone</strong>.&#8221; But the triploo@mail.ru account isn&#8217;t connected to much else that&#8217;s interesting except a now-deleted account at <strong>Vkontakte</strong>, the Russian answer to Facebook.</p>
<p>However, in Sept. 2020, Apathyp sent a private message on Verified to the owner of a stolen credit card shop, saying his credentials no longer worked. Apathyp told the proprietor that his chosen password on the service was &#8220;<strong>12Apathy</strong>.&#8221;</p>
<p>A search on that password at Constella reveals it was used by just four different email addresses, two of which are particularly interesting: <strong>gezze@yandex.ru </strong>and <strong>gezze@mail.ru</strong>. Constella discovered that both of these addresses were previously associated with the same password as triploo@mail.ru &#8212; &#8220;niceone,&#8221; or some variation thereof.</p>
<p>Constella found that years ago gezze@mail.ru was used to create a Vkontakte account under the name <strong>Ivan Sherban</strong> (former password: &#8220;<strong>12niceone</strong>&#8220;) from Magnitogorsk, an industrial city in the southern region of Russia. That same email address is now tied to a Vkontakte account for an Ivan Sherban who lists his home as Saint Petersburg, Russia. Sherban&#8217;s profile photo <a href="media/1412e014.gezze.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/gezze.png" target="_blank" rel="noopener">shows</a> a heavily tattooed, muscular and <a href="media/d4cf9c59.gezze-car.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/gezze-car.png" target="_blank" rel="noopener">recently married</a> individual with his beautiful new bride getting ready to drive off in a convertible sports car.</p>
<p>A pivotal clue for validating the research into Apathyp/Fearlless came from the identity intelligence firm <a href="https://mynetwatchman.com" target="_blank" rel="noopener">myNetWatchman</a>, which found that gezze@mail.ru at one time used the passwords &#8220;<strong>геззи1991</strong>&#8221; (gezze1991) and &#8220;<strong>gezze18081991</strong>.&#8221;</p>
<p>Care to place a wager on when Vkontakte says is Mr. Sherban&#8217;s birthday? Ten points if you answered <strong>August 18</strong> (18081991).</p>
<p>Mr. Sherban did not respond to multiple requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=65594
title: It’s Still Easy for Anyone to Become You at Experian
uri: It-s-Still-Easy-for-Anyone-to-Become-You-at-Experian
url: https://krebsonsecurity.com/2023/11/its-still-easy-for-anyone-to-become-you-at-experian/
content:
<p>In the summer of 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/" target="_blank" rel="noopener">documented</a> the plight of several readers who had their accounts at big-three consumer credit reporting bureau <strong>Experian</strong> hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hacked, and the only way I could recover access was by recreating the account.</p>
<div id="attachment_65607" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65607" decoding="async" class=" wp-image-65607" src="media/1127eac4.exp-forgot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/exp-forgot.png" alt="" width="749" height="381" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/11/exp-forgot.png 953w, https://krebsonsecurity.com/wp-content/uploads/2023/11/exp-forgot-768x391.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/11/exp-forgot-782x398.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-65607" class="wp-caption-text">Entering my SSN and birthday at Experian showed my identity was tied to an email address I did not authorize.</p></div>
<p>I recently ordered a copy of my credit file from Experian via <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a>, but as usual Experian declined to provide it, saying they couldn&#8217;t verify my identity. Attempts to log in to my account directly at Experian.com also failed; the site said it didn&#8217;t recognize my username and/or password.</p>
<p>A request for my Experian account username required my full Social Security number and date of birth, after which the website displayed portions of an email address I never authorized and did not recognize (the full address was redacted by Experian).</p>
<p>I immediately suspected that Experian was still allowing anyone to recreate their credit file account using the same personal information but a different email address, a major authentication failure that was explored in last year&#8217;s story, <a href="https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/" target="_blank" rel="noopener">Experian, You Have Some Explaining to Do</a>. So once again I sought to re-register as myself at Experian.</p>
<p>The homepage said I needed to provide a Social Security number and mobile phone number, and that I&#8217;d soon receive a link that I should click to verify myself. The site claims that the phone number you provide will be used to help validate your identity. But it appears you could supply any phone number in the United States at this stage in the process, and Experian&#8217;s website would not balk. <em>Regardless, users can simply skip this step by selecting the option to &#8220;Continue another way.&#8221;</em></p>
<p>Experian then asks for your full name, address, date of birth, Social Security number, email address and chosen password. After that, they require you to successfully answer between three to five multiple-choice security questions whose answers are very often based on public records. When I recreated my account this week, only two of the five questions pertained to my real information, and both of those questions concerned street addresses we&#8217;ve previously lived at &#8212; information that is just a Google search away.</p>
<p>Assuming you sail through the multiple-choice questions, you&#8217;re prompted to create a 4-digit PIN and provide an answer to one of several pre-selected challenge questions. After that, your new account is created and you&#8217;re directed to the Experian dashboard, which allows you to view your full credit file, and freeze or unfreeze it.</p>
<p>At this point, Experian will send a message to the old email address tied to the account, saying certain aspects of the user profile have changed. But this message isn&#8217;t a request seeking verification: It&#8217;s just a notification from Experian that the account&#8217;s user data has changed, and the original user is offered zero recourse here other than to a click a link to log in at Experian.com.</p>
<div id="attachment_65605" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65605" decoding="async" loading="lazy" class=" wp-image-65605" src="media/6cb01737.expupdates.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/expupdates.png" alt="" width="750" height="707" /><p id="caption-attachment-65605" class="wp-caption-text">If you don&#8217;t have an Experian account, it&#8217;s a good idea to create one. Because at least then you will receive one of these  emails when someone hijacks your credit file at Experian.</p></div>
<p>And of course, a user who receives one of these notices will find that the credentials to their Experian account no longer work. Nor do their PIN or account recovery question, because those have been changed also. Your only option at this point is recreate your account at Experian and steal it back from the ID thieves!</p>
<p>In contrast, if you try to modify an existing account at either of the other two major consumer credit reporting bureaus &#8212; <strong>Equifax</strong> or <strong>TransUnion</strong> &#8212; they will ask you to enter a code sent to the email address or phone number on file before any changes can be made.</p>
<p>Reached for comment, Experian declined to share the full email address that was added without authorization to my credit file.</p>
<p>&#8220;To ensure the protection of consumers’ identities and information, we have implemented a multi-layered security approach, which includes passive and active measures, and are constantly evolving,&#8221; Experian spokesperson <strong>Scott Anderson</strong> said in an emailed statement. &#8220;This includes knowledge-based questions and answers, and device possession and ownership verification processes.&#8221;</p>
<p>Anderson said all consumers have the option to activate a multi-factor authentication method that&#8217;s requested each time they log in to their account. But what good is multi-factor authentication if someone can simply recreate your account with a new phone number and email address?<span id="more-65594"></span></p>
<p>Several readers who spotted <a href="https://infosec.exchange/@briankrebs/111383547431806668" target="_blank" rel="noopener">my rant about Experian on Mastodon</a> earlier this week responded to a request to validate my findings. The Mastodon user <a href="https://infosec.exchange/@jackerbee@cyberplace.social" target="_blank" rel="noopener">@Jackerbee</a> is a reader from Michican who works in the biotechnology industry. @Jackerbee said when prompted by Experian to provide his phone number and the last four digits of his SSN, he chose the option to &#8220;manually enter my information.&#8221;</p>
<p>&#8220;I put my second phone number and the new email address,&#8221; he explained. &#8220;I received a single email in my original account inbox that said they&#8217;ve updated my information after I &#8216;signed up.&#8217; No verification required from the original email address at any point. I also did not receive any text alerts at the original phone number. The especially interesting and egregious part is that when I sign in, it does 2FA with the new phone number.&#8221;</p>
<p>The Mastodon user <a href="https://infosec.exchange/@PeteMayo" target="_blank" rel="noopener">PeteMayo</a> said they recreated their Experian account twice this week, the second time by supplying a random landline number.</p>
<p>&#8220;The only difference: it asked me FIVE questions about my personal history (last time it only asked three) before proclaiming, &#8216;Welcome back, Pete!,&#8217; and granting full access,&#8221; @PeteMayo wrote. &#8220;I feel silly saving my password for Experian; may as well just make a new account every time.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter  wp-image-65611" src="media/ccc4be7a.petemayo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/petemayo.png" alt="" width="748" height="479" /></p>
<p>I was fortunate in that whoever hijacked my account did not also thaw my credit freeze.  Or if they did, they politely froze it again when they were done. But I fully expect my Experian account will be hijacked yet again unless Experian makes some important changes to its authentication process.</p>
<p>It boggles the mind that these fundamental authentication weaknesses have been allowed to persist for so long at Experian, which already has a horrible track record in this regard.</p>
<p>In December 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/" target="_blank" rel="noopener">alerted</a> Experian that identity thieves had worked out a remarkably simple way to bypass its security and access <em>any</em> consumer’s full credit report — armed with nothing more than a person’s name, address, date of birth, and Social Security number. Experian fixed the glitch, and acknowledged that it <a href="https://krebsonsecurity.com/2023/01/experian-glitch-exposing-credit-files-lasted-47-days/" target="_blank" rel="noopener">persisted for nearly seven weeks</a>, between Nov. 9, 2022 and Dec. 26, 2022.</p>
<p>In April 2021, KrebsOnSecurity revealed how identity thieves were <a href="https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/" target="_blank" rel="noopener">exploiting lax authentication on Experian’s PIN retrieval page</a> to unfreeze consumer credit files. In those cases, Experian failed to send any notice via email when a freeze PIN was retrieved, nor did it require the PIN to be sent to an email address already associated with the consumer’s account.</p>
<p>A few days after that April 2021 story, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2021/04/experian-api-exposed-credit-scores-of-most-americans/" target="_blank" rel="noopener">an Experian API was exposing the credit scores of most Americans</a>.</p>
<p>More greatest hits from Experian:</p>
<p>2022: <a href="https://krebsonsecurity.com/2022/08/class-action-targets-experian-over-account-security/" rel="noopener" target="_blank">Class Action Targets Experian Over Account Security</a><br />
2017: <a href="https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/" target="_blank" rel="noopener">Experian Site Can Give Anyone Your Credit Freeze PIN</a><br />
2015: <a href="https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/" target="_blank" rel="noopener">Experian Breach Affects 15 Million Customers</a><br />
2015: <a href="https://krebsonsecurity.com/2014/05/experian-breach-tied-to-ny-nj-id-theft-ring/" target="_blank" rel="noopener">Experian Breach Tied to NY-NJ ID Theft Ring</a><br />
2015: <a href="https://krebsonsecurity.com/2015/10/at-experian-security-attrition-amid-acquisitions/" target="_blank" rel="noopener">At Experian, Security Attrition Amid Acquisitions</a><br />
2015: <a href="https://krebsonsecurity.com/2015/07/experian-hit-with-class-action-over-id-theft-service/" target="_blank" rel="noopener">Experian Hit With Class Action Over ID Theft Service</a><br />
2014: <a href="https://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank" rel="noopener">Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records</a><br />
2013: <a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">Experian Sold Consumer Data to ID Theft Service</a></p>


feed_id: https://krebsonsecurity.com/?p=65633
title: Microsoft Patch Tuesday, November 2023 Edition
uri: Microsoft-Patch-Tuesday-November-2023-Edition
url: https://krebsonsecurity.com/2023/11/microsoft-patch-tuesday-november-2023-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix more than five dozen security holes in its <strong>Windows</strong> operating systems and related software, including three &#8220;zero day&#8221; vulnerabilities that Microsoft warns are already being exploited in active attacks.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="841" height="592" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 841px) 100vw, 841px" /></p>
<p>The zero-day threats targeting Microsoft this month include <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025" target="_blank" rel="noopener">CVE-2023-36025</a>, a weakness that allows malicious content to bypass the Windows SmartScreen Security feature. SmartScreen is a built-in Windows component that tries to detect and block malicious websites and files. Microsoft&#8217;s security advisory for this flaw says attackers could exploit it by getting a Windows user to click on a booby-trapped link to a shortcut file.</p>
<p><strong>Kevin Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>, said emails with .url attachments or logs with processes spawning from .url files &#8220;should be a high priority for threat hunters given the active exploitation of this vulnerability in the wild.&#8221;<span id="more-65633"></span></p>
<p>The second zero day this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033" target="_blank" rel="noopener">CVE-2023-36033</a>, which is a vulnerability in the &#8220;DWM Core Library&#8221; in Microsoft Windows that was exploited in the wild as a zero day and publicly disclosed prior to patches being available. It affects Microsoft Windows 10 and later, as well as Microsoft Windows Server 2019 and subsequent versions.</p>
<p>&#8220;This vulnerability can be exploited locally, with low complexity and without needing high-level privileges or user interaction,&#8221; said <strong>Mike Walters</strong>, president and co-founder of the security firm <strong>Action1</strong>. &#8220;Attackers exploiting this flaw could gain SYSTEM privileges, making it an efficient method for escalating privileges, especially after initial access through methods like phishing.&#8221;</p>
<p>The final zero day in this month&#8217;s Patch Tuesday is a problem in the &#8220;Windows Cloud Files Mini Filter Driver&#8221; tracked as <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036" target="_blank" rel="noopener">CVE-2023-36036</a> that affects Windows 10 and later, as well as Windows Server 2008 at later. Microsoft says it is relatively straightforward for attackers to exploit CVE-2023-36036 as a way to elevate their privileges on a compromised PC.</p>
<p>Beyond the zero day flaws, Breen said organizations running <strong>Microsoft Exchange Server</strong> should prioritize several new Exchange patches, including <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36439" target="_blank" rel="noopener">CVE-2023-36439</a>, which is a bug that would allow attackers to install malicious software on an Exchange server. This weakness technically requires the attacker to be authenticated to the target&#8217;s local network, but Breen notes that a pair of phished Exchange credentials will provide that access nicely.</p>
<p>&#8220;This is typically achieved through social engineering attacks with spear phishing to gain initial access to a host before searching for other vulnerable internal targets – just because your Exchange Server doesn&#8217;t have internet-facing authentication doesn’t mean it&#8217;s protected,&#8221; Breen said.</p>
<p>Breen said this vulnerability goes hand in hand with three other Exchange bugs that Microsoft designated as &#8220;exploitation more likely:&#8221; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36050" target="_blank" rel="noopener">CVE-2023-36050</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36039" target="_blank" rel="noopener">CVE-2023-36039</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36035" target="_blank" rel="noopener">CVE-2023-36035</a>.</p>
<p>Finally, the <strong>SANS Internet Storm Center</strong> <a href="https://isc.sans.edu/forums/diary/Microsoft%20Patch%20Tuesday%20November%202023/30400/" target="_blank" rel="noopener">points to</a> two additional bugs patched by Microsoft this month that aren&#8217;t yet showing signs of active exploitation but that were made public prior to today and thus deserve prioritization. Those include: <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36038" target="_blank" rel="noopener">CVE-2023-36038</a>, a denial of service vulnerability in <strong>ASP.NET Core</strong>, with a CVSS score of 8.2; and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36413" target="_blank" rel="noopener">CVE-2023-36413</a>: A <strong>Microsoft Office</strong> security feature bypass. Exploiting this vulnerability will bypass the protected mode when opening a file received via the web.</p>
<p>Windows users, please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any difficulties as a result of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=65630
title: Alleged Extortioner of Psychotherapy Patients Faces Trial
uri: Alleged-Extortioner-of-Psychotherapy-Patients-Faces-Trial
url: https://krebsonsecurity.com/2023/11/alleged-extortioner-of-psychotherapy-patients-faces-trial/
content:
<p>Prosecutors in Finland this week commenced their criminal trial against <strong>Julius Kivimäki</strong>, a 26-year-old Finnish man charged with extorting a once popular and now-bankrupt online psychotherapy practice and thousands of its patients. In a 2,200-page report, Finnish authorities laid out how they connected the extortion spree to Kivimäki, a notorious hacker who was <a href="https://krebsonsecurity.com/2015/07/finnish-decision-is-win-for-internet-trolls/" target="_blank" rel="noopener">convicted in 2015</a> of perpetrating tens of thousands of cybercrimes, including data breaches, payment fraud, operating a botnet and calling in bomb threats.</p>
<p><img decoding="async" class="aligncenter wp-image-61773" src="media/0074dfea.kikmaki-wanted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png" alt="" width="750" height="357" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png 2936w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-768x366.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-1536x731.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-2048x975.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-782x372.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>In November 2022, Kivimäki was charged with attempting to extort money from the <strong>Vastaamo Psychotherapy Center</strong>. In that breach, which occurred in October 2020, a hacker using the handle “Ransom Man” threatened to publish patient psychotherapy notes if Vastaamo did not pay a six-figure ransom demand.</p>
<p>Vastaamo refused, so Ransom Man shifted to extorting individual patients — sending them targeted emails threatening to publish their therapy notes unless paid a 500-euro ransom. When Ransom Man found little success extorting patients directly, they uploaded to the dark web a large compressed file containing all of the stolen Vastaamo patient records.</p>
<p>Security experts soon discovered Ransom Man had mistakenly included an entire copy of their home folder, where investigators found many clues pointing to Kivimäki’s involvement. By that time, Kivimäki was no longer in Finland, but the Finnish government nevertheless <a href="https://krebsonsecurity.com/2022/11/hacker-charged-with-extorting-online-psychotherapy-service/" target="_blank" rel="noopener">charged Kivimäki in absentia with the Vastaamo hack</a>. The 2,200-page evidence document against Kivimäki suggests he enjoyed a lavish lifestyle while on the lam, frequenting luxury resorts and renting fabulously expensive cars and living quarters.</p>
<p>But in February 2023, Kivimäki was <a href="https://krebsonsecurity.com/2023/02/finlands-most-wanted-hacker-nabbed-in-france/" target="_blank" rel="noopener">arrested in France</a> after authorities there responded to a domestic disturbance call and found the defendant sleeping off a hangover on the couch of a woman he&#8217;d met the night before. The French police grew suspicious when the 6&#8242; 3&#8243; blonde, green-eyed man presented an ID that stated he was of Romanian nationality.</p>
<div id="attachment_65661" style="width: 692px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65661" decoding="async" loading="lazy" class=" wp-image-65661" src="media/26c170ba.kivimaki-romainianid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/kivimaki-romainianid.png" alt="" width="682" height="466" /><p id="caption-attachment-65661" class="wp-caption-text">A redacted copy of an ID Kivimaki gave to French authorities claiming he was from Romania.</p></div>
<p>Finnish prosecutors showed that Kivimäki&#8217;s credit card had been used to pay for the virtual server that hosted the stolen Vastaamo patient notes. What&#8217;s more, the home folder included in the Vastaamo patient data archive also allowed investigators to peer into other cybercrime projects of the accused, including domains that Ransom Man had access to as well as a lengthy history of commands he&#8217;d executed on the rented virtual server.</p>
<p>Some of those domains allegedly administered by Kivimäki were set up to smear the reputations of different companies and individuals. One of those was a website that claimed to have been authored by a person who headed up IT infrastructure for a major bank in Norway which discussed the idea of legalizing child sexual abuse.</p>
<p>Another domain hosted a fake blog that besmirched the reputation of a Tulsa, Okla. man whose name was attached to blog posts about supporting the &#8220;white pride&#8221; movement and calling for a pardon of the <a href="https://en.wikipedia.org/wiki/Timothy_McVeigh" target="_blank" rel="noopener">Oklahoma City bomber Timothy McVeigh</a>.</p>
<p>Kivimäki appears to have sought to sully the name of this reporter as well. The 2,200-page document shows that Kivimäki owned and operated the domain <strong>krebsonsecurity[.]org</strong>, which hosted various hacking tools that Kivimäki allegedly used, including programs for mass-scanning the Internet for systems vulnerable to known security flaws, as well as scripts for cracking database server usernames and passwords, and downloading databases.<span id="more-65630"></span></p>
<div id="attachment_65662" style="width: 654px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65662" decoding="async" loading="lazy" class="size-full wp-image-65662" src="media/12e2b053.kos-org-bash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/kos-org-bash.png" alt="" width="644" height="866" /><p id="caption-attachment-65662" class="wp-caption-text">Ransom Man inadvertently included a copy of his home directory in the leaked Vastaamo patient data. A lengthy history of the commands run by that user show they used krebsonsecurity-dot-org to host hacking and scanning tools.</p></div>
<p><strong>Mikko Hyppönen</strong>, chief research officer at WithSecure (formerly F-Secure), said the Finnish authorities have done &#8220;amazing work,&#8221; and that &#8220;it&#8217;s rare to have this much evidence for a cybercrime case.&#8221;</p>
<p><strong>Petteri Järvinen</strong> is a respected IT expert and author who has been following the trial, and he said the prosecution&#8217;s case so far has been strong.</p>
<p>&#8220;The National Bureau of Investigation has done a good job and Mr Kivimäki for his part some elementary mistakes,&#8221; Järvinen <a href="https://www.linkedin.com/posts/petterij_vastaamo-activity-7130135333010046976-81_v" target="_blank" rel="noopener">wrote</a> on LinkedIn. &#8220;This sends an important message: online crime does not pay. Traces are left in the digital world too, even if it is very tedious for the police to collect them from servers all around the world.&#8221;</p>
<p><strong>Antti Kurittu</strong> is an information security specialist and a former criminal investigator. In 2013, Kurittu worked on an investigation involving Kivimäki’s use of the <a href="https://krebsonsecurity.com/tag/zeus-trojan/" target="_blank" rel="noopener">Zbot botnet</a>, among other activities Kivimäki engaged in as a member of the hacker group <a href="https://www.exploit-db.com/papers/25306" target="_blank" rel="noopener">Hack the Planet</a> (HTP). Kurittu said it remains to be seen if the prosecution can make their case, and if the defense has any answers to all of the evidence presented.</p>
<p>&#8220;Based on the public pretrial investigation report, it looks like the case has a lot of details that seem very improbable to be coincidental,&#8221; Kurittu told KrebsOnSecurity. &#8220;For example, a full copy of the Vastaamo patient database was found on a server that belonged to Scanifi, a company with no reasonable business that Kivimäki was affiliated with. The leaked home folder contents were also connected to Kivimäki and were found on servers that were under his control.&#8221;</p>
<p>The Finnish daily <em>yle.fi</em> <a href="https://yle.fi/a/74-20059985" target="_blank" rel="noopener">reports</a> that Kivimäki&#8217;s lawyers sought to have their client released from confinement for the remainder of his trial, noting that the defendant has already been detained for eight months.</p>
<p>The court denied that request, saying the defendant was still a flight risk. Kivimäki&#8217;s trial is expected to continue until February 2024, in part to accommodate testimony from a large number of victims. Prosecutors are seeking a seven-year sentence for Kivimäki.</p>


feed_id: https://krebsonsecurity.com/?p=65422
title: ID Theft Service Resold Access to USInfoSearch Data
uri: ID-Theft-Service-Resold-Access-to-USInfoSearch-Data
url: https://krebsonsecurity.com/2023/11/id-theft-service-resold-access-to-usinfosearch-data/
content:
<p>One of the cybercrime underground&#8217;s more active sellers of Social Security numbers, background and credit reports has been pulling data from hacked accounts at the U.S. consumer data broker <strong>USinfoSearch</strong>, KrebsOnSecurity has learned.</p>
<p><img decoding="async" class="alignright wp-image-65699" src="media/8c2e3269.usislookups.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/usislookups.png" alt="" width="300" height="668" />Since at least February 2023, a service advertised on Telegram called <strong>USiSLookups</strong> has operated an automated bot that allows anyone to look up the SSN or background report on virtually any American. For prices ranging from $8 to $40 and payable via virtual currency, the bot will return detailed consumer background reports automatically in just a few moments.</p>
<p>USiSLookups is the project of a cybercriminal who uses the nicknames <strong>JackieChan/USInfoSearch</strong>, and the Telegram channel for this service includes a small number of sample background reports, including that of <strong>President Joe Biden</strong>, and podcaster <strong>Joe Rogan</strong>. The data in those reports includes the subject&#8217;s date of birth, address, previous addresses, previous phone numbers and employers, known relatives and associates, and driver&#8217;s license information.</p>
<p>JackieChan&#8217;s service abuses the name and trademarks of Columbus, OH based data broker <strong>USinfoSearch</strong>, whose website says it provides &#8220;identity and background information to assist with risk management, fraud prevention, identity and age verification, skip tracing, and more.&#8221;</p>
<p>&#8220;We specialize in non-FCRA data from numerous proprietary sources to deliver the information you need, when you need it,&#8221; the company&#8217;s website explains. &#8220;Our services include API-based access for those integrating data into their product or application, as well as bulk and batch processing of records to suit every client.&#8221;</p>
<p>As luck would have it, my report was also listed in the Telegram channel for this identity fraud service, presumably as a teaser for would-be customers. On October 19, 2023, KrebsOnSecurity shared a copy of this file with the real USinfoSearch, along with a request for information about the provenance of the data.</p>
<p>USinfoSearch said it would investigate the report, which appears to have been obtained on or before June 30, 2023. On Nov. 9, 2023, <strong>Scott Hostettler</strong>, general manager of USinfoSearch parent <strong>Martin Data LLC</strong> shared a written statement about their investigation that suggested the ID theft service was trying to pass off someone else&#8217;s consumer data as coming from USinfoSearch:</p>
<blockquote><p>Regarding the Telegram incident, we understand the importance of protecting sensitive information and upholding the trust of our users is our top priority. Any allegation that we have provided data to criminals is in direct opposition to our fundamental principles and the protective measures we have established and continually monitor to prevent any unauthorized disclosure. Because Martin Data has a reputation for high-quality data, thieves may steal data from other sources and then disguise it as ours. While we implement appropriate safeguards to guarantee that our data is only accessible by those who are legally permitted, unauthorized parties will continue to try to access our data. Thankfully, the requirements needed to pass our credentialing process is tough even for established honest companies.</p></blockquote>
<p>USinfoSearch&#8217;s statement did not address any questions put to the company, such as whether it requires multi-factor authentication for customer accounts, or whether my report had actually come from USinfoSearch&#8217;s systems.</p>
<p>After much badgering, on Nov. 21 Hostettler acknowledged that the USinfoSearch identity fraud service on Telegram was in fact pulling data from an account belonging to a vetted USinfoSearch client.</p>
<p>&#8220;I do know 100% that my company did not give access to the group who created the bots, but they did gain access to a client,&#8221; Hostettler said of the Telegram-based identity fraud service. &#8220;I apologize for any inconvenience this has caused.&#8221;</p>
<p>Hostettler said USinfoSearch heavily vets any new potential clients, and that all users are required to undergo a background check and provide certain documents. Even so, he said, several fraudsters each month present themselves as credible business owners or C-level executives during the credentialing process, completing the application and providing the necessary documentation to open a new account.</p>
<p>&#8220;The level of skill and craftsmanship demonstrated in the creation of these supporting documents is incredible,&#8221; Hostettler said. &#8220;The numerous licenses provided appear to be exact replicas of the original document. Fortunately, I&#8217;ve discovered several methods of verification that do not rely solely on those documents to catch the fraudsters.&#8221;</p>
<p>&#8220;These people are unrelenting, and they act without regard for the consequences,&#8221; Hostettler continued. &#8220;After I deny their access, they will contact us again within the week using the same credentials. In the past, I&#8217;ve notified both the individual whose identity is being used fraudulently and the local police. Both are hesitant to act because nothing can be done to the offender if they are not apprehended. That is where most attention is needed.&#8221;<span id="more-65422"></span></p>
<h2>SIM SWAPPER&#8217;S DELIGHT</h2>
<p>JackieChan is most active on Telegram channels focused on &#8220;<strong>SIM swapping</strong>,&#8221; which involves bribing or tricking mobile phone company employees into <a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">redirecting a target&#8217;s phone number to a device the attackers control</a>. SIM swapping allows crooks to temporarily intercept the target&#8217;s text messages and phone calls, including any links or one-time codes for authentication that are delivered via SMS.</p>
<p>Reached on Telegram, JackieChan said most of his clients hail from the criminal SIM swapping world, and that the bulk of his customers use his service via an application programming interface (API) that allows customers to integrate the lookup service with other web-based services, databases, or applications.</p>
<p>&#8220;Sim channels is where I get most of my customers,&#8221; JackieChan told KrebsOnSecurity. &#8220;I&#8217;m averaging around 100 lookups per day on the [Telegram] bot, and around 400 per day on the API.&#8221;</p>
<p>JackieChan claims his USinfoSearch bot on Telegram abuses stolen credentials needed to access an API used by the real USinfoSearch, and that his service was powered by USinfoSearch account credentials that were stolen by malicious software tied to a botnet that he claims to have operated for some time.</p>
<p>This is not the first time USinfoSearch has had trouble with identity thieves masquerading as legitimate customers. In 2013, KrebsOnSecurity broke the news that an identity fraud service in the underground called &#8220;<strong>SuperGet[.]info</strong>&#8221; was <a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">reselling access to personal and financial data on more than 200 million Americans</a> that was obtained via the big-three credit bureau <strong>Experian</strong>.</p>
<p>The consumer data resold by Superget was not obtained directly from Experian, but rather via USinfoSearch. At the time, USinfoSearch had a contractual agreement with a California company named <strong>Court Ventures</strong>, whereby customers of Court Ventures had access to the USinfoSearch data, and vice versa.</p>
<p>When Court Ventures was purchased by Experian in 2012, the proprietor of SuperGet &#8212; a Vietnamese hacker named <strong>Hieu Minh Ngo</strong> who had impersonated an American private investigator &#8212; was grandfathered in as a client. The <strong>U.S. Secret Service</strong> agent who oversaw Ngo&#8217;s capture, extradition, prosecution and rehabilitation <a href="//krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/" target="_blank" rel="noopener">told KrebsOnSecurity</a> he&#8217;s unaware of any other cybercriminal who has caused more material financial harm to more Americans than Ngo.</p>
<h2>REAL POLICE, FAKE EDRS</h2>
<p>JackieChan also sells access to hacked email accounts belonging to law enforcement personnel in the United States and abroad. Hacked police department emails can come in handy for ID thieves trying to pose as law enforcement officials who wish to purchase consumer data from platforms like USinfoSearch. Hence, Mr. Hostettler&#8217;s ongoing battle with fraudsters seeking access to his company&#8217;s service.</p>
<p>These police credentials are mainly marketed to criminals seeking <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">fraudulent &#8220;Emergency Data Requests,</a>&#8221; wherein crooks use compromised government and police department email accounts to rapidly obtain customer account data from mobile providers, ISPs and social media companies.</p>
<p>Normally, these companies will require law enforcement officials to supply a subpoena before turning over customer or user records. But EDRs allow police to bypass that process by attesting that the information sought is related to an urgent matter of life and death, such as an impending suicide or terrorist attack.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-59128" src="media/b7372c46.legalrequest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png" alt="" width="750" height="623" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-782x650.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>In response to an alarming increase in the volume of fraudulent EDRs, many service providers have chosen to require all EDRs be processed through <a href="https://krebsonsecurity.com/2022/04/fighting-fake-edrs-with-credit-ratings-for-police/" target="_blank" rel="noopener">a service called Kodex</a>, which seeks to filter EDRs based on the reputation of the law enforcement entity requesting the information, and other attributes of the requestor.</p>
<p>For example, if you want to send an EDR to<strong> Coinbase</strong> or <strong>Twilio</strong>, you&#8217;ll first need to have valid law enforcement credentials and create an account at the Kodex online portal at these companies. However, Kodex may still throttle or block any requests from any accounts if they set off certain red flags.</p>
<p>Within their own separate Kodex portals, Twilio can’t see requests submitted to Coinbase, or vice versa. But each can see if a law enforcement entity or individual tied to one of their own requests has ever submitted a request to a different Kodex client, and then drill down further into other data about the submitter, such as Internet address(es) used, and the age of the requestor’s email address.</p>
<p>In August, JackieChan was advertising a working Kodex account for sale on the cybercrime channels, including redacted screenshots of the Kodex account dashboard as proof of access.</p>
<p>Kodex co-founder <strong>Matt Donahue</strong> told KrebsOnSecurity his company immediately detected that the law enforcement email address used to create the Kodex account pictured in JackieChan&#8217;s ad was likely stolen from a police officer in India. One big tipoff, Donahue said, was that the person creating the account did so using an Internet address in Brazil.</p>
<p>&#8220;There&#8217;s a lot of friction we can put in the way for illegitimate actors,&#8221; Donahue said. &#8220;We don&#8217;t let people use VPNs. In this case we let them in to honeypot them, and that&#8217;s how they got that screenshot. But nothing was allowed to be transmitted out from that account.&#8221;</p>
<p>Massive amounts of data about you and your personal history are available from USinfoSearch and dozens of other data brokers that acquire and sell &#8220;non-FCRA&#8221; data &#8212; i.e., consumer data that cannot be used for the purposes of determining one&#8217;s eligibility for credit, insurance, or employment.</p>
<p>Anyone who works in or adjacent to law enforcement is eligible to apply for access to these data brokers, which often market themselves to police departments and to &#8220;skip tracers,&#8221; essentially bounty hunters hired to locate others in real life &#8212; often on behalf of debt collectors, process servers or a bail bondsman.</p>
<p>There are tens of thousands of police jurisdictions around the world — including roughly <a href="https://en.wikipedia.org/wiki/Law_enforcement_in_the_United_States#:~:text=There%20are%2017%2C985%20U.S.%20police,and%20federal%20law%20enforcement%20agencies." target="_blank" rel="noopener">18,000 in the United States alone</a>. And the harsh reality is that all it takes for hackers to apply for access to data brokers (and abuse the EDR process) is illicit access to a single police email account.</p>
<p>The trouble is, compromised credentials to law enforcement email accounts show up for sale with alarming frequency on the Telegram channels where JackieChan and their many clients reside. Indeed, Donahue said Kodex so far this year has identified attempted fake EDRs coming from compromised email accounts for police departments in India, Italy, Thailand and Turkey.</p>


feed_id: https://krebsonsecurity.com/?p=65742
title: Okta: Breach Affected All Customer Support Users
uri: Okta-Breach-Affected-All-Customer-Support-Users
url: https://krebsonsecurity.com/2023/11/okta-breach-affected-all-customer-support-users/
content:
<p>When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant <strong>Okta</strong> had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised that impact statement, saying the attackers also stole the name and email address for nearly all of its customer support users.</p>
<p><img decoding="async" class="aligncenter  wp-image-65407" src="media/9ed08d01.okta-ss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/okta-ss.png" alt="" width="749" height="475" /></p>
<p>Okta <a href="https://krebsonsecurity.com/2023/10/hackers-stole-access-tokens-from-oktas-support-unit/" target="_blank" rel="noopener">acknowledged</a> last month that for several weeks beginning in late September 2023, intruders had access to its customer support case management system. That access allowed the hackers to steal authentication tokens from some Okta customers, which the attackers could then use to make changes to customer accounts, such as adding or modifying authorized users.</p>
<p>In its initial incident reports about the breach, Okta <a href="https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/" target="_blank" rel="noopener">said</a> the hackers gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers, or less than 1% of Okta&#8217;s customer base.</p>
<p>But in <a href="https://sec.okta.com/harfiles/" target="_blank" rel="noopener">an updated statement</a> published early this morning, Okta said it determined the intruders also stole the names and email addresses of all Okta customer support system users.</p>
<p>&#8220;All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor),&#8221; Okta&#8217;s advisory states. &#8220;The Auth0/CIC support case management system was also not impacted by this incident.&#8221;<span id="more-65742"></span></p>
<p>Okta said that for nearly 97 percent of users, the only contact information exposed was full name and email address. That means about three percent of Okta customer support accounts had one or more of the following data fields exposed (in addition to email address and name): last login; username; phone number; SAML federation ID; company name; job role; user type; date of last password change or reset.</p>
<p>Okta notes that a large number of the exposed accounts belong to Okta administrators &#8212; IT people responsible for integrating Okta&#8217;s authentication technology inside customer environments &#8212; and that these individuals should be on guard for targeted phishing attacks.</p>
<p>&#8220;Many users of the customer support system are Okta administrators,&#8221; Okta pointed out. &#8220;It is critical that these users have multi-factor authentication (MFA) enrolled to protect not only the customer support system, but also to secure access to their Okta admin console(s).&#8221;</p>
<p>While it may seem completely bonkers that some companies allow their IT staff to operate company-wide authentication systems using an Okta administrator account that isn&#8217;t protected with MFA, Okta said <em>fully six percent of its customers (more than 1,000) persist in this dangerous practice.</em></p>
<p>In <a href="https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/" rel="noopener" target="_blank">a previous disclosure on Nov. 3</a>, Okta blamed the intrusion on an employee who saved the credentials for a service account in Okta&#8217;s customer support infrastructure to their personal Google account, and said it was likely those credentials were stolen when the employee&#8217;s personal device using the same Google account was compromised.</p>
<p>Unlike standard user accounts, which are accessed by humans, service accounts are mostly reserved for automating machine-to-machine functions, such as performing data backups or antivirus scans every night at a particular time. For this reason, they can’t be locked down with multifactor authentication the way user accounts can. </p>
<p>Dan Goodin over at Ars Technica <a href="https://arstechnica.com/information-technology/2023/11/no-okta-senior-management-not-an-errant-employee-caused-you-to-get-hacked/" rel="noopener" target="_blank">reckons</a> this explains why MFA wasn’t set up on the compromised Okta service account. But as he rightly point out, if a transgression by a single employee breaches your network, you&#8217;re doing it wrong.</p>
<p>&#8220;Okta should have put access controls in place besides a simple password to limit who or what could log in to the service account,&#8221; Goodin wrote on Nov. 4. &#8220;One way of doing this is to put a limit or conditions on the IP addresses that can connect. Another is to regularly rotate access tokens used to authenticate to service accounts. And, of course, it should have been impossible for employees to be logged in to personal accounts on a work machine. These and other precautions are the responsibility of senior people inside Okta.&#8221;</p>
<p>Goodin suggested that people who want to delve further into various approaches for securing service accounts should read <a href="https://infosec.exchange/@dangoodin/111348246005935166" rel="noopener" target="_blank">this thread on Mastodon</a>. </p>
<p>&#8220;A fair number of the contributions come from security professionals with extensive experience working in sensitive cloud environments,&#8221; Goodin wrote.</p>


feed_id: https://krebsonsecurity.com/?p=65757
title: ICANN Launches Service to Help With WHOIS Lookups
uri: ICANN-Launches-Service-to-Help-With-WHOIS-Lookups
url: https://krebsonsecurity.com/2023/12/icann-launches-service-to-help-with-whois-lookups/
content:
<p>More than five years after domain name registrars started redacting personal data from all public domain registration records, the non-profit organization overseeing the domain industry has introduced a centralized online service designed to make it easier for researchers, law enforcement and others to request the information directly from registrars.</p>
<p><img decoding="async" class="aligncenter wp-image-42559" src="media/03721200.whois.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/whois.png" alt="" width="750" height="148" /></p>
<p>In May 2018, the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN) — the nonprofit entity that manages the global domain name system &#8212; <a href="https://krebsonsecurity.com/2018/02/new-eu-privacy-law-may-weaken-security/" target="_blank" rel="noopener">instructed</a> all registrars to redact the customer&#8217;s name, address, phone number and email from WHOIS, the system for querying databases that store the registered users of domain names and blocks of Internet address ranges.</p>
<p>ICANN made the policy change in response to the <a href="https://gdpr-info.eu/" target="_blank" rel="noopener">General Data Protection Regulation</a> (GDPR), a law enacted by the European Parliament that requires companies to gain affirmative consent for any personal information they collect on people within the European Union. In the meantime, registrars were to continue collecting the data but not publish it, and ICANN promised it would develop a system that facilitates access to this information.</p>
<p>At the end of November 2023, ICANN launched the <a href="https://www.icann.org/rdrs-en" target="_blank" rel="noopener">Registration Data Request Service</a> (RDRS), which is designed as a one-stop shop to submit registration data requests to participating registrars. <a href="https://www.youtube.com/watch?v=xI8PdvBAEY8" target="_blank" rel="noopener">This video from ICANN</a> walks through how the system works.</p>
<p>Accredited registrars don&#8217;t have to participate, but ICANN is <a href="https://icann.zoom.us/rec/play/KCd4qRTbYM1vgvgrnEFGBlo0j5a0oK8GGDjaNXUitMWMQc5dg29wKVqo95rS_VSypSYN12lsuIPAt31T.y33PPacHdhPuQ8X0" target="_blank" rel="noopener">asking</a> all registrars to join and says participants can opt out or stop using it at any time. ICANN contends that the use of a standardized request form makes it easier for the correct information and supporting documents to be provided to evaluate a request.</p>
<p>ICANN says the RDRS doesn&#8217;t guarantee access to requested registration data, and that all communication and data disclosure between the registrars and requestors takes place outside of the system. The service can&#8217;t be used to request WHOIS data tied to country-code top level domains (CCTLDs), such as those ending in .de (Germany) or .nz (New Zealand), for example.<span id="more-65757"></span></p>
<div id="attachment_65765" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65765" decoding="async" loading="lazy" class=" wp-image-65765" src="media/b809302f.rdrs-portal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/rdrs-portal.png" alt="" width="749" height="491" /><p id="caption-attachment-65765" class="wp-caption-text">The RDRS portal.</p></div>
<p>As <strong>Catalin Cimpanu</strong> <a href="https://riskybiznews.substack.com/p/icann-launches-rdrs-tool-help-cyber-professional" target="_blank" rel="noopener">writes</a> for <em>Risky Business News</em>, currently investigators can file legal requests or abuse reports with each individual registrar, but the idea behind the RDRS is to create a place where requests from &#8220;verified&#8221; parties can be honored faster and with a higher degree of trust.</p>
<p>The registrar community generally views public WHOIS data as a nuisance issue for their domain customers and an unwelcome cost-center. Privacy advocates maintain that cybercriminals don&#8217;t provide their real information in registration records anyway, and that requiring WHOIS data to be public simply causes domain registrants to be pestered by spammers, scammers and stalkers.</p>
<p>Meanwhile, security experts argue that even in cases where online abusers provide intentionally misleading or false information in WHOIS records, that information is still extremely useful in mapping the extent of their malware, phishing and scamming operations. What&#8217;s more, the overwhelming majority of phishing is performed with the help of compromised domains, and the primary method for cleaning up those compromises is using WHOIS data to contact the victim and/or their hosting provider.</p>
<p>Anyone looking for copious examples of both need only to <a href="https://krebsonsecurity.com/?s=whois&amp;x=0&amp;y=0" target="_blank" rel="noopener">search this Web site for the term “WHOIS,”</a> which yields dozens of stories and investigations that simply would not have been possible without the data available in the global WHOIS records.</p>
<p>KrebsOnSecurity remains doubtful that participating registrars will be any more likely to share WHOIS data with researchers just because the request comes through ICANN. But I look forward to being wrong on this one, and will certainly mention it in my reporting if the RDRS proves useful.</p>
<p>Regardless of whether the RDRS succeeds or fails, there is another European law that takes effect in 2024 which is likely to place additional pressure on registrars to respond to legitimate WHOIS data requests. The new <a href="https://eur-lex.europa.eu/eli/dir/2022/2555" target="_blank" rel="noopener">Network and Information Security Directive</a> (NIS2), which EU member states have until October 2024 to implement, requires registrars to keep much more accurate WHOIS records, and to respond <a href="https://journals.library.columbia.edu/index.php/stlr/blog/view/577" target="_blank" rel="noopener">within as little as 24 hours</a> to WHOIS data requests tied everything from phishing, malware and spam to copyright and brand enforcement.</p>


feed_id: https://krebsonsecurity.com/?p=65686
title: Microsoft Patch Tuesday, December 2023 Edition
uri: Microsoft-Patch-Tuesday-December-2023-Edition
url: https://krebsonsecurity.com/2023/12/microsoft-patch-tuesday-december-2023-edition/
content:
<p>The final Patch Tuesday of 2023 is upon us, with <strong>Microsoft Corp.</strong> today releasing fixes for a relatively small number of security holes in its <strong>Windows</strong> operating systems and other software. Even more unusual, there are no known &#8220;zero-day&#8221; threats targeting any of the vulnerabilities in December&#8217;s patch batch. Still, four of the updates pushed out today address &#8220;critical&#8221; vulnerabilities that Microsoft says can be exploited by malware or malcontents to seize complete control over a vulnerable Windows device with little or no help from users.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="748" height="495" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></p>
<p>Among the critical bugs quashed this month is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35628" target="_blank" rel="noopener">CVE-2023-35628</a>, a weakness present in <strong>Windows 10</strong> and later versions, as well as <strong>Microsoft Server 2008</strong> and later. <strong>Kevin Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>, said the flaw affects <strong>MSHTML</strong>, a core component of Windows that is used to render browser-based content. Breen notes that MSHTML also can be found in a number of Microsoft applications, including <strong>Office</strong>, <strong>Outlook</strong>, <strong>Skype</strong> and <strong>Teams</strong>.</p>
<p>&#8220;In the worst-case scenario, Microsoft suggests that simply receiving an email would be enough to trigger the vulnerability and give an attacker code execution on the target machine without any user interaction like opening or interacting with the contents,&#8221; Breen said.<span id="more-65686"></span></p>
<p>Another critical flaw that probably deserves priority patching is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35641" target="_blank" rel="noopener">CVE-2023-35641</a>, a remote code execution weakness in a built-in Windows feature called the <strong>Internet Connection Sharing</strong> (ICS) service that lets multiple devices share an Internet connection. While CVE-2023-35641 earned a high vulnerability severity score (a CVSS rating of 8.8), the threat from this flaw may be limited somewhat because an attacker would need to be on the same network as the target. Also, while ICS is present in all versions of Windows since Windows 7, it is not on by default (although some applications may turn it on).</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, notes that a number of the non-critical patches released today were identified by Microsoft as “more likely to be exploited.” For example, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35636">CVE-2023-35636</a>, which Microsoft says is an information disclosure vulnerability in Outlook. An attacker could exploit this flaw by convincing a potential victim to open a specially crafted file delivered via email or hosted on a malicious website.</p>
<p>Narang said what makes this one stand out is that exploitation of this flaw would lead to <a href="https://www.netwrix.com/pass_the_hash_attack_explained.html" target="_blank" rel="noopener">the disclosure of NTLM hashes</a>, which could be leveraged as part of an NTLM relay or &#8220;pass the hash&#8221; attack, which lets an attacker masquerade as a legitimate user without ever having to log in.</p>
<p>&#8221;It is reminiscent of <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397" target="_blank" rel="noopener">CVE-2023-23397</a>, an elevation of privilege vulnerability in Microsoft Outlook that was exploited in the wild as a zero day and patched in the <a href="https://krebsonsecurity.com/2023/03/microsoft-patch-tuesday-march-2023-edition/" target="_blank" rel="noopener">March 2023 Patch Tuesday</a> release,&#8221; Narang said. &#8220;However, unlike CVE-2023-23397, CVE-2023-35636 is not exploitable via Microsoft’s Preview Pane, which lowers the severity of this flaw.&#8221;</p>
<p>As usual, the <a href="https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20December%202023/30480" target="_blank" rel="noopener">SANS Internet Storm Center</a> has a good roundup on all of the patches released today and indexed by severity. Windows users, please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any difficulties as a result of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=65738
title: Ten Years Later, New Clues in the Target Breach
uri: Ten-Years-Later-New-Clues-in-the-Target-Breach
url: https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/
content:
<p>On Dec. 18, 2013, KrebsOnSecurity <a href="https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" target="_blank" rel="noopener">broke the news</a> that U.S. retail giant <strong>Target</strong> was battling a wide-ranging computer intrusion that compromised more than 40 million customer payment cards over the previous month. The malware used in the Target breach included the text string &#8220;<strong>Rescator</strong>,&#8221; which also was the handle chosen by the cybercriminal who was selling all of the cards stolen from Target customers. Ten years later, KrebsOnSecurity has uncovered new clues about the real-life identity of Rescator.</p>
<div id="attachment_26445" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-26445" decoding="async" class=" wp-image-26445" src="media/45cf2842.rescator-rr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/06/rescator-rr.png" alt="" width="750" height="533" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/06/rescator-rr.png 967w, https://krebsonsecurity.com/wp-content/uploads/2014/06/rescator-rr-285x202.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/06/rescator-rr-600x426.png 600w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-26445" class="wp-caption-text">Rescator, advertising a new batch of cards stolen in a 2014 breach at P.F. Chang&#8217;s.</p></div>
<p>Shortly after breaking the Target story, KrebsOnSecurity <a href="https://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank" rel="noopener">reported</a> that Rescator appeared to be a hacker from Ukraine. Efforts to confirm my reporting with that individual ended when they declined to answer questions, and after I declined to accept a bribe of $10,000 not to run my story.</p>
<p>That reporting was based on clues from an early Russian cybercrime forum in which a hacker named Rescator &#8212; using the same profile image that Rescator was known to use on other forums &#8212; claimed to have originally been known as &#8220;Helkern,&#8221; the nickname chosen by the administrator of a cybercrime forum called Darklife.</p>
<p>KrebsOnSecurity began revisiting the research into Rescator&#8217;s real-life identity in 2018, after the <strong>U.S. Department of Justice</strong> unsealed an indictment that <a href="https://krebsonsecurity.com/2018/02/u-s-arrests-13-charges-36-in-infraud-cybercrime-forum-bust/" target="_blank" rel="noopener">named a different Ukrainian man</a> as Helkern.</p>
<p>It may be helpful to first recap why Rescator is thought to be so closely tied to the Target breach. For starters, the text string &#8220;Rescator&#8221; was found in <a href="https://web.archive.org/web/20140120201116/https://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware" target="_blank" rel="noopener">some of the malware</a> used in the Target breach. Investigators would later determine that <a href="https://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/" target="_blank" rel="noopener">a variant of the malware used in the Target breach</a> was used in 2014 to <a href="https://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/" target="_blank" rel="noopener">steal 56 million payment cards</a> from <strong>Home Depot</strong> customers. And once again, cards stolen in the Home Depot breach were sold exclusively at Rescator&#8217;s shops.</p>
<p>On Nov. 25, 2013, two days before Target said the breach officially began, Rescator could be seen in instant messages hiring another forum member to verify 400,000 payment cards that Rescator claimed were freshly stolen.</p>
<p>By the first week of December 2013, Rescator&#8217;s online store &#8212; <strong>rescator[.]la</strong> &#8212; was selling more than six million payment card records stolen from Target customers. Prior to the Target breach, Rescator had mostly sold much smaller batches of stolen card and identity data, and the website allowed cybercriminals to automate the sending of fraudulent wire transfers to <a href="https://krebsonsecurity.com/tag/money-mules/" target="_blank" rel="noopener">money mules</a> based in Lviv, Ukraine.</p>
<p>Finally, there is <em>some</em> honor among thieves, and in the marketplace for stolen payment card data it is considered poor form to advertise a batch of cards as &#8220;yours&#8221; if you are merely reselling cards sold to you by a third-party card vendor or thief. When serious stolen payment card shop vendors wish to communicate that a batch of cards is uniquely their handiwork or that of their immediate crew, they refer to it as &#8220;our base.&#8221; And Rescator was quite clear in his advertisements that these millions of cards were obtained firsthand.</p>
<h2>FLASHBACK</h2>
<p>The new clues about Rescator&#8217;s identity came into focus when I revisited the reporting around an April 2013 story here that <a href="https://krebsonsecurity.com/2013/04/who-wrote-the-flashback-os-x-worm/" target="_blank" rel="noopener">identified the author of the OSX Flashback Trojan</a>, an early Mac malware strain that quickly <a href="https://en.wikipedia.org/wiki/Flashback_(Trojan)" target="_blank" rel="noopener">spread to more than 650,000 Mac computers worldwide in 2012</a>.</p>
<p>That story about the Flashback author was possible because a source had obtained a Web browser authentication cookie for a founding member of a Russian cybercrime forum called <strong>BlackSEO</strong>. Anyone in possession of that cookie could then browse the invite-only BlackSEO forum and read the user&#8217;s private messages without having to log in.</p>
<div id="attachment_19687" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-19687" decoding="async" loading="lazy" class=" wp-image-19687" src="media/33ec11d1.FlashbackBlackSEO.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/04/FlashbackBlackSEO.png" alt="" width="749" height="530" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/04/FlashbackBlackSEO.png 946w, https://krebsonsecurity.com/wp-content/uploads/2013/04/FlashbackBlackSEO-285x201.png 285w, https://krebsonsecurity.com/wp-content/uploads/2013/04/FlashbackBlackSEO-600x424.png 600w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-19687" class="wp-caption-text">BlackSEO.com VIP member &#8220;Mavook&#8221; tells forum admin Ika in a private message that he is the Flashback author.</p></div>
<p>The legitimate owner of that BlackSEO user cookie went by the nickname <strong>Ika</strong>, and Ika&#8217;s private messages on the forum showed he was close friends with the Flashback author. At the time, Ika also was the administrator of <strong>Pustota[.]pw</strong> &#8212; a closely-guarded Russian forum that counted among its members some of the world&#8217;s most successful and established spammers and malware writers.</p>
<p>For many years, Ika held a key position at one of Russia&#8217;s largest Internet service providers, and his (mostly glowing) reputation as a reliable provider of web hosting to the Russian cybercrime community gave him an encyclopedic knowledge about nearly every major player in that scene at the time.</p>
<p>The story on the Flashback author featured redacted screenshots that were taken from Ika&#8217;s BlackSEO account (see image above). The day after that story ran, Ika posted a farewell address to his mates, expressing shock and bewilderment over the apparent compromise of his BlackSEO account.</p>
<p>In a lengthy post on April 4, 2013 titled &#8220;I DON&#8217;T UNDERSTAND ANYTHING,&#8221; Ika told Pustota forum members he was so spooked by recent events that he was closing the forum and quitting the cybercrime business entirely. Ika recounted how the Flashback story had come the same week that rival cybercriminals tried to &#8220;dox&#8221; him (their dox named the wrong individual, but included some of Ika&#8217;s more guarded identities).</p>
<p>&#8220;It&#8217;s no secret that karma farted in my direction,&#8221; Ika said at the beginning of his post. Unbeknownst to Ika at the time, his Pustota forum also had been completely hacked that week, and a copy of its database shared with this author.</p>
<div id="attachment_65789" style="width: 760px" class="wp-caption aligncenter"><a href="media/6aac936a.ika-pustota-goodbye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65789" decoding="async" loading="lazy" class="wp-image-65789" src="media/6aac936a.ika-pustota-goodbye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye.png" alt="" width="750" height="307" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye.png 1692w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye-768x315.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye-1536x629.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye-782x320.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-65789" class="wp-caption-text">A Google translated version of the farewell post from Ika, the administrator of Pustota, a Russian language cybercrime forum focused on botnets and spam. Click to enlarge.</p></div>
<p>Ika said the two individuals who tried to dox him did so on an even more guarded Russian language forum &#8212; <strong>DirectConnection[.]ws</strong>, perhaps the most exclusive Russian cybercrime community ever created. New applicants of this forum had to pay a non-refundable deposit, and receive vouches by three established cybercriminals already on the forum. Even if one managed to steal (or guess) a user&#8217;s DirectConnection password, the login page could not be reached unless the visitor also possessed a special browser certificate that the forum administrator gave only to approved members.</p>
<p>In no uncertain terms, Ika declared that Rescator went by the nickname <strong>MikeMike</strong> on DirectConnection:</p>
<blockquote><p>&#8220;I did not want to bring any of this to real life. Especially since I knew the patron of the clowns &#8211; specifically Pavel Vrublevsky. Yes, I do state with confidence that the man with the nickname Rescator a.k.a. MikeMike with his partner <strong>Pipol</strong> have been Pavel Vrublevsky&#8217;s puppets for a long time.&#8221;</p></blockquote>
<p><strong>Pavel Vrublevsky</strong> is a convicted cybercriminal who became famous as the CEO of the Russian e-payments company <strong>ChronoPay</strong>, which specialized in facilitating online payments for a variety of &#8220;high-risk&#8221; businesses, including gambling, pirated Mp3 files, <a href="https://krebsonsecurity.com/2011/03/chronopays-scareware-diaries/" target="_blank" rel="noopener">rogue antivirus software</a> and &#8220;male enhancement&#8221; pills.</p>
<p>As detailed in my 2014 book <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0" target="_blank" rel="noopener"><em>Spam Nation</em></a>, Vrublevsky not-so-secretly ran a pharmacy affiliate spam program called <strong>Rx-Promotion</strong>, which <a href="https://krebsonsecurity.com/2011/02/russian-cops-crash-pill-pusher-party/" target="_blank" rel="noopener">paid spammers and virus writers</a> to blast out tens of billions of junk emails advertising generic Viagra and controlled pharmaceuticals like pain relief medications. Much of my reporting on Vrublevsky&#8217;s cybercrime empire came from several years worth of internal ChronoPay emails and documents that were leaked online in 2010 and 2011.</p>
<div id="attachment_21009" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-21009" decoding="async" loading="lazy" class=" wp-image-21009" src="media/5ccf9bdb.vrubsword.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/06/vrubsword.png" alt="" width="750" height="503" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/06/vrubsword.png 452w, https://krebsonsecurity.com/wp-content/uploads/2013/06/vrubsword-285x191.png 285w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-21009" class="wp-caption-text">Pavel Vrublevsky&#8217;s former Facebook profile photo.</p></div>
<p><span id="more-65738"></span></p>
<h2>ZAXVATMIRA</h2>
<p>In 2014, KrebsOnSecurity learned from a trusted source close to the Target breach investigation that the user MikeMike on DirectConnection &#8212; the same account that Ika said belonged to Rescator &#8212; used the email address &#8220;<strong>zaxvatmira@gmail.com</strong>.&#8221;</p>
<p>At the time, KrebsOnSecurity could not connect that email address to anything or anyone. However, a recent search on zaxvatmira@gmail.com at the breach tracking service <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> returns just one result: An account created in November 2010 at the site searchengines[.]ru under the handle  &#8220;<strong>r-fac1</strong>.&#8221;</p>
<p>A search on &#8220;r-fac1&#8221; at cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> revealed that this user&#8217;s introductory post on searchengines[.]ru advertised <strong>musictransferonline[.]com</strong>, an affiliate program that paid people to drive traffic to sites that sold pirated music files for pennies apiece.</p>
<p>According to leaked ChronoPay emails from 2010, this domain was registered and paid for by ChronoPay. Those missives also show that in August 2010 Vrublevsky authorized a payment of ~$1,200 for a multi-user license of an Intranet service called <strong>MegaPlan</strong>.</p>
<p>ChronoPay <a href="https://krebsonsecurity.com/2011/06/organization-chart-reveals-chronopay%E2%80%99s-links-to-shady-internet-projects/" target="_blank" rel="noopener">used the MegaPlan service</a> to help manage the sprawling projects that Vrublevsky referred to internally as their “black” payment processing operations, including pirated pills, porn, Mp3s, and fake antivirus products. ChronoPay employees used their MegaPlan accounts to track payment disputes, order volumes, and advertising partnerships for these high-risk programs.</p>
<p>Borrowing a page from the Quentin Tarantino movie <a title="IMDB: Reservoir Dogs" href="http://www.imdb.com/title/tt0105236/" target="_blank" rel="noopener">Reservoir Dogs</a>, the employees adopted nicknames like “Mr. Kink,” “Mr. Heppner,” and “Ms. Nati.” However, in a classic failure of operational security, many of these employees had their MegaPlan account messages automatically forwarded to their real ChronoPay email accounts.</p>
<div id="attachment_9761" style="width: 760px" class="wp-caption aligncenter"><a href="media/0d995a9b.CurlyRx.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/05/CurlyRx.jpg" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-9761" decoding="async" loading="lazy" class="wp-image-9761" src="media/0d995a9b.CurlyRx.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/05/CurlyRx.jpg" alt="" width="750" height="445" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/05/CurlyRx.jpg 981w, https://krebsonsecurity.com/wp-content/uploads/2011/05/CurlyRx-300x177.jpg 300w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-9761" class="wp-caption-text">A screen shot of the org chart from ChronoPay&#8217;s MegaPlan Intranet system.</p></div>
<p>When ChronoPay&#8217;s internal emails were leaked in 2010, the username and password for its MegaPlan subscription were still working and valid. An internal user directory for that subscription included the personal (non-ChronoPay) email address tied to each employee Megaplan nickname. That directory listing said the email address zaxvatmira@gmail.com was assigned to the head of the <strong>Media/Mp3</strong> division for ChronoPay, pictured at the top left of the organizational chart above as &#8220;<strong>Babushka Vani and Koli.&#8221;</strong></p>
<p>[Author&#8217;s note: I initially overlooked the presence of the email address zaxvatmira@gmail.com in my notes because it did not show up in text searches of my saved emails, files or messages. I rediscovered it recently when a text search for zaxvatmira@gmail.com on my Mac found the address in a screenshot of the ChronoPay MegaPlan interface.]</p>
<p>The nickname two rungs down from &#8220;Babushka&#8221; in the ChronoPay org chart is &#8220;<strong>Lev Tolstoy</strong>,&#8221; which the MegaPlan service showed was picked by someone who used the email address <strong>v.zhabukin@freefrog-co-ru</strong>.</p>
<p>ChronoPay&#8217;s emails show that this Freefrog email address belongs to a <strong>Vasily Borisovich Zhabykin</strong> from Moscow. The Russian business tracking website rusprofile[.]ru reports that Zhabykin is or was the supervisor or owner of three Russian organizations, including one called <strong>JSC Hot Spot</strong>.</p>
<p>[Author&#8217;s note: The word &#8220;babushka&#8221; means &#8220;grandma&#8221; in Russian, and it could be that this nickname is a nod to the ChronoPay CEO&#8217;s wife, <strong>Vera</strong>. The leaked ChronoPay emails show that Vera Vrublevsky managed a group of hackers working with their media division, and was at least nominally in charge of MP3 projects for ChronoPay. Indeed, in messages exposed by the leaked ChronoPay email cache, Zhabykin stated that he was &#8220;directly subordinate&#8221; to Mrs. Vrublevsky].</p>
<h2>CYBERCRIME HOTSPOT</h2>
<p>JSC Hot Spot is interesting because its co-founder is another ChronoPay employee: 37-year-old <strong>Mikhail &#8220;Mike&#8221; Shefel</strong>. A <a href="https://www.facebook.com/people/%D0%9C%D0%B8%D1%85%D0%B0%D0%B8%D0%BB-%D0%A8%D0%B5%D1%84%D0%B5%D0%BB%D1%8C/pfbid035s2ZCFwQUKUvaeAPM5S2o5WvpVYRvjwrcW5eXspnpfN4JzwQBdsDWqApe3mdnRUPl/" target="_blank" rel="noopener">Facebook profile for Mr. Shefel</a> says he is or was vice president of payment systems at ChronoPay. However, the last update on that profile is from 2018, when Shefel appears to have legally changed his last name.</p>
<p>Archive.org shows that Hot Spot&#8217;s website &#8212; <a href="media/9954b94a.myhotspot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/myhotspot.png" target="_blank" rel="noopener">myhotspot[.]ru</a> &#8212; sold a variety of consulting services, including IT security assessments, code and system audits, and email marketing. The earliest recorded archive of the Hot Spot website listed three clients on its homepage, including ChronoPay and Freefrog.</p>
<p>ChronoPay internal emails show that Freefrog was one of its investment projects that facilitated the sale of pirated Mp3 files. Rusprofile[.]ru reports that Freefrog&#8217;s official company name &#8212; <strong>JSC Freefrog</strong> &#8212; is incorporated by a thinly-documented entity based in the Seychelles called <strong>Impex Consulting Ltd.</strong>, and it is unclear who its true owners are.</p>
<p>However, a search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> on the phone number listed on the homepage of myhotspot[.]ru (<strong>74957809554</strong>) reveals that number is associated with eight domain names.</p>
<p>Six of those domains are some variation of FreeFrog. Another domain registered to that phone number is <a href="https://web.archive.org/web/20120402022836/http://www.bothunter.me/users/sign_in" target="_blank" rel="noopener"><strong>bothunter[.]me</strong></a>, which included a copyright credit to &#8220;Hot Spot 2011.&#8221; At the annual Russian Internet Week IT convention in Moscow in 2012, Mr. Shefel <a href="https://www.youtube.com/watch?v=CFNIdFI41rA" target="_blank" rel="noopener">gave a short presentation about bothunter</a>, which he described as a service he designed to identify inauthentic (bot) accounts on Russian social media networks.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/CFNIdFI41rA?si=Z6x_ukamf0Jrbqo2" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Interestingly, one of r-fac1&#8217;s first posts to Searchengines[.]ru a year earlier saw this user requesting help from other members who had access to large numbers of hacked social media accounts. R-fac1 told forum members that he was only looking to use those accounts to post harmless links and comments to the followers of the hacked profiles, and his post suggested he was testing something.</p>
<p>&#8220;Good afternoon,&#8221; r-fac1 wrote on Dec. 20, 2010. &#8220;I&#8217;m looking for people with their own not-recently-registered accounts on forums, (except for search) Social networks, Twitter, blogs, their websites. Tasks, depending on your accounts, post text and a link, sometimes just a link. Most often the topic is chatter, relaxation, discussion. Posting my links in your profiles, on your walls. A separate offer for people with a large set of contacts in instant messengers to try to use viral marketing.&#8221;</p>
<p>Neither Mr. Shefel nor Mr. Zhabykin responded to requests for comment.</p>
<h2>WHERE ARE THEY NOW?</h2>
<p>Mr. Zhabykin soon moved on to bigger ventures, co-founding a cryptocurrency exchange based in Moscow&#8217;s financial center called <strong>Suex</strong>. In September 2021, Suex earned the distinction of becoming the first crypto firm to be <a href="https://home.treasury.gov/news/press-releases/jy0364" target="_blank" rel="noopener">sanctioned</a> by the <strong>U.S. Department of the Treasury</strong>, which effectively blocked Suex from the global financial system. The Treasury alleged Suex helped to process millions in criminal transactions, including the proceeds of numerous ransomware attacks.</p>
<p>&#8220;I don’t understand how I got mixed up in this,&#8221; Zhabykin <a href="https://www.nytimes.com/2021/09/21/us/politics/treasury-department-combating-ransomware-cryptocurrency.html" target="_blank" rel="noopener">told</a> <em>The New York Times</em> in 2021. Zhabykin said Suex, which is registered in the Czech Republic, was mostly a failure and had conducted only a half dozen or so transactions since 2019.</p>
<p>The Russian business tracking service Rusprofile says Zhabykin also is the owner of a company based in the United Kingdom called <strong>RideWithLocal</strong>; the company&#8217;s website says it specializes in arranging excursions for extreme sports, including snowboarding, skiing, surfing and parasailing. Images from the RideWithLocal Facebook page show helicopters dropping snowboarders and skiers atop some fairly steep mountains.</p>
<div id="attachment_65788" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65788" decoding="async" loading="lazy" class="wp-image-65788" src="media/c87d5d38.ridewithlocal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/ridewithlocal.png" alt="" width="750" height="392" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/12/ridewithlocal.png 1156w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ridewithlocal-768x401.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ridewithlocal-782x409.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ridewithlocal-267x140.png 267w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-65788" class="wp-caption-text">A screenshot from the Facebook page of RideWithLocal.</p></div>
<p class="p1">Constella Intelligence found a cached copy of a now-deleted LinkedIn profile for Mr. Zhabykin, who described himself as a &#8220;sporttech/fintech specialist and mentor.&#8221;</p>
<p class="p1">&#8220;I create products and services worldwide, focusing on innovation and global challenges,&#8221; his LinkedIn profile said. &#8220;I&#8217;ve started my career in 2002 and since then I worked in Moscow, different regions of Russia, including Siberia and in Finland, Brazil, United Kingdom, Sri Lanka. Over the last 15 years I contributed to many amazing products in the following industries: sports, ecology, sport tech, fin tech, electronic payments, big data, telecommunications, pulp and paper industry, wood processing and travel. My specialities are Product development, Mentorship, Strategy and Business development.&#8221;</p>
<p>Rusprofile reports that <strong>Mikhail Borisovich Shefel</strong> is associated with at least eight current or now-defunct companies in Russia, including <strong>Dengi IM</strong> (Money IM), <strong>Internet Capital</strong>, <strong>Internet Lawyer</strong>, <strong>Internet 2</strong>, Zao Hot Spot, and (my personal favorite) an entity incorporated in 2021 called &#8220;<strong>All the Money in the World</strong>.&#8221;</p>
<p>Constella Intelligence found several official documents for Mr. Shefel that came from hacked Russian phone, automobile and residence records. They indicate Mr. Shefel is the registrant of a black Porsche Cayenne (Plate:X537SR197) and a Mercedes (Plate:P003PX90). Those vehicle records show Mr. Shefel was born on May 28, 1986.</p>
<p>Rusprofile reveals that at some point near the end of 2018, Shefel changed his last name to <strong>Lenin</strong>. DomainTools reports that in 2018, Mr. Shefel&#8217;s company Internet 2 LLC registered the domain name <strong>Lenin[.]me. </strong>This now-defunct service sold physical USSR-era Ruble notes that bear the image of Vladimir Lenin, the founding father of the Soviet Union.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-65786" src="media/f3dabab7.lenin-me.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/lenin-me.png" alt="" width="749" height="365" /></p>
<p>Meanwhile, Pavel Vrublevsky remains imprisoned in Russia, awaiting trial on <a href="https://krebsonsecurity.com/2022/03/spam-nation-villain-vrublevsky-charged-with-fraud/" target="_blank" rel="noopener">fraud charges levied against the payment company CEO in March 2022</a>. Authorities allege Vrublevsky operated several fraudulent SMS-based payment schemes. They also accused Vrublevsky of facilitating money laundering for <a href="https://en.wikipedia.org/wiki/Hydra_Market" target="_blank" rel="noopener">Hydra</a>, the largest Russian darknet market. Hydra trafficked in illegal drugs and financial services, including cryptocurrency tumbling for money laundering, exchange services between cryptocurrency and Russian rubles, and the sale of falsified documents and hacking services.</p>
<p>In 2013, Vrublevsky was sentenced to 2.5 years in a Russian penal colony for convincing one of his top spammers and botmasters to launch a distributed denial-of-service (DDoS) attack against a ChronoPay competitor that shut down the ticketing system for the state-owned Aeroflot airline.</p>
<p>Following his release, Vrublevsky began working on a new digital payments platform based in Hong Kong called HPay Ltd (a.k.a. Hong Kong Processing Corporation). HPay appears to have had a great number of clients that were running schemes which bamboozled people with fake lotteries and prize contests.</p>
<p>KrebsOnSecurity sought comment on this research from the <strong>Federal Bureau of Investigation</strong> (FBI) and the <strong>U.S. Secret Service</strong>, both of which have been involved in the Target breach investigation over the years. The FBI declined to comment. The Secret Service declined to confirm or dispute any of the findings, but said it is still interested in hearing from anyone who might have more information.</p>
<p>&#8220;The U.S. Secret Service does not comment on any open investigation and won’t confirm or deny the accuracy in any reporting related to a criminal manner,&#8221; the agency said in a written statement. &#8220;However, If you have any information relating to the subjects referenced in this article, please contact the U.S. Secret Service at mostwanted@usss.dhs.gov. The Secret Service pays a reward for information leading to the arrest of cybercriminals.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=65924
title: BlackCat Ransomware Raises Ante After FBI Disruption
uri: BlackCat-Ransomware-Raises-Ante-After-FBI-Disruption
url: https://krebsonsecurity.com/2023/12/blackcat-ransomware-raises-ante-after-fbi-disruption/
content:
<p>The <strong>U.S. Federal Bureau of Investigation</strong> (FBI) disclosed today that it infiltrated the world&#8217;s second most prolific ransomware gang, a Russia-based criminal group known as <strong>ALPHV</strong> and <strong>BlackCat</strong>. The FBI said it seized the gang&#8217;s darknet website, and released a decryption tool that hundreds of victim companies can use to recover systems. Meanwhile, BlackCat responded by briefly &#8220;unseizing&#8221; its darknet site with a message promising 90 percent commissions for affiliates who continue to work with the crime group, and open season on everything from hospitals to nuclear power plants.</p>
<div id="attachment_65929" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65929" decoding="async" class=" wp-image-65929" src="media/2bc385bc.blackcatseizure-santaversion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/blackcatseizure-santaversion.png" alt="" width="749" height="465" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/12/blackcatseizure-santaversion.png 1134w, https://krebsonsecurity.com/wp-content/uploads/2023/12/blackcatseizure-santaversion-768x477.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/12/blackcatseizure-santaversion-782x485.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-65929" class="wp-caption-text">A slightly modified version of the FBI seizure notice on the BlackCat darknet site (Santa caps added).</p></div>
<p>Whispers of a possible law enforcement action against BlackCat came in the first week of December, after the ransomware group&#8217;s darknet site went offline and remained unavailable for roughly five days. BlackCat eventually managed to bring its site back online, blaming the outage on <a href="https://twitter.com/vxunderground/status/1737087379142242581" target="_blank" rel="noopener">equipment malfunctions</a>.</p>
<p>But earlier today, the BlackCat website was replaced with an FBI seizure notice, while federal prosecutors in Florida released <a href="https://www.justice.gov/media/1329536/dl?inline" target="_blank" rel="noopener">a search warrant</a> explaining how FBI agents were able to gain access to and disrupt the group&#8217;s operations.</p>
<p>A <a href="https://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant" target="_blank" rel="noopener">statement</a> on the operation from the <strong>U.S. Department of Justice</strong> says the FBI developed a decryption tool that allowed agency field offices and partners globally to offer more than 500 affected victims the ability to restore their systems.</p>
<p>“With a decryption tool provided by the FBI to hundreds of ransomware victims worldwide, businesses and schools were able to reopen, and health care and emergency services were able to come back online,&#8221; <strong>Deputy Attorney General Lisa O. Monaco</strong> said. &#8220;We will continue to prioritize disruptions and place victims at the center of our strategy to dismantle the ecosystem fueling cybercrime.&#8221;</p>
<p>The DOJ reports that since BlackCat&#8217;s formation roughly 18 months ago, the crime group has targeted the computer networks of more than 1,000 victim organizations. BlackCat attacks usually involve encryption and theft of data; if victims refuse to pay a ransom, the attackers typically publish the stolen data on a BlackCat-linked darknet site.</p>
<p>BlackCat formed by recruiting operators from several competing or disbanded ransomware organizations — including <a href="https://krebsonsecurity.com/?s=REvil" target="_blank" rel="noopener">REvil</a>, <a href="https://krebsonsecurity.com/?s=blackmatter" target="_blank" rel="noopener">BlackMatter</a> and <a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener">DarkSide</a>. The latter group was responsible for the <a href="https://www.wired.com/story/darkside-ransomware-colonial-pipeline-response/" target="_blank" rel="noopener">Colonial Pipeline attack in May 2021</a> that caused nationwide fuel shortages and price spikes.</p>
<p>Like many other ransomware operations, BlackCat operates under the &#8220;ransomware-as-a-service&#8221; model, where teams of developers maintain and update the ransomware code, as well as all of its supporting infrastructure. Affiliates are incentivized to attack high-value targets because they generally reap 60-80 percent of any payouts, with the remainder going to the crooks running the ransomware operation.</p>
<p>BlackCat was able to briefly regain control over their darknet server today. Not long after the FBI&#8217;s seizure notice went live the homepage was &#8220;unseized&#8221; and retrofitted with a statement about the incident from the ransomware group&#8217;s perspective.<span id="more-65924"></span></p>
<div id="attachment_65930" style="width: 663px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65930" decoding="async" loading="lazy" class="size-full wp-image-65930" src="media/713d2274.blackcat-unseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/blackcat-unseized.png" alt="" width="653" height="622" /><p id="caption-attachment-65930" class="wp-caption-text">The message that was briefly on the homepage of the BlackCat ransomware group this morning. Image: @GossiTheDog.</p></div>
<p>BlackCat claimed that the FBI&#8217;s operation only touched a portion of its operations, and that as a result of the FBI&#8217;s actions an additional 3,000 victims will no longer have the option of receiving decryption keys. The group also said it was formally removing any restrictions or discouragement against targeting hospitals or other critical infrastructure.</p>
<p>&#8220;Because of their actions, we are introducing new rules, or rather, we are removing ALL rules except one, you cannot touch the CIS [a common restriction against attacking organizations in Russia or the <a href="https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States" target="_blank" rel="noopener">Commonwealth of Independent States</a>]. You can now block hospitals, nuclear power plants, anything, anywhere.&#8221;</p>
<p>The crime group also said it was setting affiliate commissions at 90 percent, presumably to attract interest from potential affiliates who might otherwise be spooked by the FBI&#8217;s recent infiltration. BlackCat also promised that all &#8220;advertisers&#8221; under this new scheme would manage their affiliate accounts from data centers that are completely isolated from each other.</p>
<p>BlackCat&#8217;s darknet site currently displays the FBI seizure notice. But as <em>BleepingComputer</em> founder <strong>Lawrence Abrams</strong> <a href="https://infosec.exchange/@lawrenceabrams/111609034173801015" target="_blank" rel="noopener">explained on Mastodon</a>, both the FBI and BlackCat have the private keys associated with the Tor hidden service URL for BlackCat&#8217;s victim shaming and data leak site.</p>
<p>&#8220;Whoever is the latest to publish the hidden service on Tor (in this case the BlackCat data leak site), will resume control over the URL,&#8221; Abrams said. &#8220;Expect to see this type of back and forth over the next couple of days.&#8221;</p>
<p>The DOJ says anyone with <a href="https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/" target="_blank" rel="noopener">information about BlackCat affiliates</a> or their activities may be eligible for up to a $10 million reward through the State Department&#8217;s &#8220;<a href="https://rewardsforjustice.net/rewards/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure/?utm_source=Newsletter&amp;utm_medium=&amp;utm_campaign=&amp;utm_term=" target="_blank" rel="noopener">Rewards for Justice</a>&#8221; program, which accepts submissions through <a href="http://he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion" target="_blank" rel="noopener">a Tor-based tip line</a> (visiting the site is only possible using the <a href="https://www.torproject.org/download/" target="_blank" rel="noopener">Tor browser</a>).</p>
<p>Further reading: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a" target="_blank" rel="noopener">CISA StopRansomware Alert on the tools, techniques and procedures used by ALPHV/BlackCat</a>.</p>


feed_id: https://krebsonsecurity.com/?p=66001
title: Happy 14th Birthday, KrebsOnSecurity!
uri: Happy-14th-Birthday-KrebsOnSecurity
url: https://krebsonsecurity.com/2023/12/happy-14th-birthday-krebsonsecurity/
content:
<p>KrebsOnSecurity celebrates its 14th year of existence today! I promised myself this post wouldn&#8217;t devolve into yet another Cybersecurity Year in Review. Nor do I wish to hold forth about whatever cyber horrors may await us in 2024. But I do want to thank you all for your continued readership, encouragement and support, without which I could not do what I do.</p>
<p><img decoding="async" class="aligncenter  wp-image-66013" src="media/4fe2c216.fourteen.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/fourteen.png" alt="" width="730" height="471" /></p>
<p>As of this birthday, I&#8217;ve officially been an independent investigative journalist for longer than I was a reporter for The Washington Post (1995-2009). Of course, not if you count the many years I worked as a paperboy schlepping The Washington Post to dozens of homes in Springfield, Va. (as a young teen, I inherited a largish paper route handed down from my elder siblings).</p>
<p>True story: At the time I was hired as a lowly copy aide by The Washington Post, all new hires &#8212; everyone from the mailroom and janitors on up to the executives &#8212; were invited to a formal dinner in the Executive Suite with the publisher <a href="https://en.wikipedia.org/wiki/Donald_E._Graham#:~:text=Graham%20became%20publisher%20of%20The,of%20The%20Washington%20Post%20Company." target="_blank" rel="noopener">Don Graham</a>. On the evening of my new hires dinner, I was feeling underdressed, undershowered and out of place. After wolfing down some food, I tried to slink away to the elevator with another copy aide, but was pulled aside by the guy who hired me. &#8220;Hey Brian, not so fast! Come over and meet Don!&#8221;</p>
<p>I was 23 years old, and I had no clue what to say except to tell him that paper route story, and that I&#8217;d already been working for him for half my life. Mr. Graham laughed and told me that was the best thing he&#8217;d heard all day. Which of course made my week, and made me feel more at ease among the suits.<span id="more-66001"></span></p>
<p>I remain grateful to WaPo for instilling many skills, such as how to distill technobabble into plain English for a general audience. And how to make people the focus of highly technical stories. Because people &#8212; and their eternal struggles &#8212; are imminently relatable, regardless of whether one has a full grasp of the technical details.</p>
<p>Words fail me when trying to describe how grateful I am that this whole independent reporter thing still works, financially and otherwise. I mostly just keep my head down researching stuff and sharing what I find, and somehow loads of people keep coming back to the site. As I like to say, I hope they let me keep doing this, because I&#8217;m certainly unqualified to do much else!</p>
<p>Another milestone of sorts: We&#8217;ve now amassed more than 52,000 subscribers to our email newsletter, which is a fancy term for a plain text email that goes out immediately whenever a new story is published here. <a href="https://krebsonsecurity.com/subscribe/" target="_blank" rel="noopener">Subscribing is free</a>, we never share anyone&#8217;s email address, and we don&#8217;t send emails other than new story notifications (2-3 per week).</p>
<p>A friendly reminder that while you may see ads (or spaces where ads otherwise would be) at the top of this website, all two-dozen or so ad creatives we run are vetted by me and served in-house. Nor does this website host any third-party content. If you regularly browse the web with an ad blocker turned on, please consider adding an exception for KrebsOnSecurity.com. Our advertising partners are how we keep the lights on over here.</p>
<p>And in case you missed any of them, here are some of the most-read stories published by KrebsOnSecurity in 2023. Happy 2024 everyone!</p>
<p><a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">Ten Years Later, New Clues in the Target Breach</a><br />
<a href="https://krebsonsecurity.com/2023/11/its-still-easy-for-anyone-to-become-you-at-experian/" target="_blank" rel="noopener">It&#8217;s Still Easy for Anyone to Become You at Experian</a><br />
<a href="https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/" target="_blank" rel="noopener">Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach</a><br />
<a href="https://krebsonsecurity.com/2023/09/why-is-us-being-used-to-phish-so-many-of-us/" target="_blank" rel="noopener">Why is .US Being Used to Phish So Many of US?</a><br />
<a href="https://krebsonsecurity.com/2023/07/few-fortune-100-firms-list-security-pros-in-their-executive-ranks/" target="_blank" rel="noopener">Few Fortune 100 Firms List Security Pros in Their Executive Ranks</a><br />
<a href="https://krebsonsecurity.com/2023/07/whos-behind-the-domainnetworks-snail-mail-scam/" target="_blank" rel="noopener">Who&#8217;s Behind the Domain Networks Snail Mail Scam?</a><br />
<a href="https://krebsonsecurity.com/2023/05/phishing-domains-tanked-after-meta-sued-freenom/" target="_blank" rel="noopener">Phishing Domains Tanked After Meta Sued Freenom</a><br />
<a href="https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/" target="_blank" rel="noopener">Many Public Salesforce Sites are Leaking Private Data</a><br />
<a href="https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/" target="_blank" rel="noopener">Hackers Claim They Breached T-Mobile More Than 100 Times in 2022</a><br />
<a href="https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/" target="_blank" rel="noopener">Identity Thieves Bypassed Experian Security to View Credit Reports</a></p>


feed_id: https://krebsonsecurity.com/?p=65945
title: Meet Ika & Sal: The Bulletproof Hosting Duo from Hell
uri: Meet-Ika-Sal-The-Bulletproof-Hosting-Duo-from-Hell
url: https://krebsonsecurity.com/2024/01/meet-ika-sal-the-bulletproof-hosting-duo-from-hell/
content:
<p>In 2020, the United States brought charges against four men accused of building a bulletproof hosting empire that once dominated the Russian cybercrime industry and supported multiple organized cybercrime groups. All four pleaded guilty to conspiracy and racketeering charges. But there is a fascinating and untold backstory behind the two Russian men involved, who co-ran the world&#8217;s top spam forum and worked closely with Russia&#8217;s most dangerous cybercriminals.</p>
<p>From January 2005 to April 2013, there were two primary administrators of the cybercrime forum <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">Spamdot</a> (a.k.a Spamit), an invite-only community for Russian-speaking people in the businesses of sending spam and building botnets of infected computers to relay said spam. The Spamdot admins went by the nicknames<strong> Icamis</strong> (a.k.a. <strong>Ika</strong>), and <strong>Salomon</strong> (a.k.a. <strong>Sal</strong>).</p>
<div id="attachment_66020" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66020" decoding="async" class="size-full wp-image-66020" src="media/0a088916.ika-tarelka.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-tarelka.png" alt="" width="757" height="503" /><p id="caption-attachment-66020" class="wp-caption-text">Spamdot forum administrator &#8220;Ika&#8221; a.k.a. &#8220;Icamis&#8221; responds to a message from &#8220;Tarelka,&#8221; the botmaster behind the Rustock botnet. Dmsell said: &#8220;I’m actually very glad that I switched to legal spam mailing,&#8221; prompting Tarelka and Ika to scoff.</p></div>
<p>As detailed in my 2014 book, <em><a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0" target="_blank" rel="noopener">Spam Nation</a></em>, Spamdot was home to crooks controlling some of the world&#8217;s nastiest botnets, global malware contagions that went by exotic names like <a href="https://krebsonsecurity.com/tag/rustock/" target="_blank" rel="noopener">Rustock</a>, <a href="https://krebsonsecurity.com/?s=cutwail" target="_blank" rel="noopener">Cutwail</a>, <a href="https://krebsonsecurity.com/?s=mega-d" target="_blank" rel="noopener">Mega-D</a>, <a href="https://krebsonsecurity.com/?s=festi" target="_blank" rel="noopener">Festi</a>, <a href="https://krebsonsecurity.com/?s=waledac" target="_blank" rel="noopener">Waledac</a>, and <a href="https://krebsonsecurity.com/2012/02/whos-behind-the-worlds-largest-spam-botnet/" target="_blank" rel="noopener">Grum</a>.</p>
<p>Icamis and Sal were in daily communications with these botmasters, via the Spamdot forum and private messages. Collectively in control over millions of spam-spewing zombies, those botmasters also continuously harvested passwords and other data from infected machines.</p>
<p>As we&#8217;ll see in a moment, Salomon is now behind bars, in part because <a href="https://krebsonsecurity.com/?s=cyberheist" target="_blank" rel="noopener">he helped to rob dozens of small businesses in the United States</a> using some of those same harvested passwords. He is currently housed in a federal prison in Michigan, serving the final stretch of a 60-month sentence.</p>
<p>But the identity and whereabouts of Icamis have remained a mystery to this author until recently. For years, security experts &#8212; and indeed, many top cybercriminals in the Spamit affiliate program &#8212; have expressed the belief that Sal and Icamis were likely the same person using two different identities. And there were many good reasons to support this conclusion.</p>
<p>For example, in 2010 Spamdot and its spam affiliate program Spamit were hacked, and its user database shows Sal and Icamis often accessed the forum from the same Internet address &#8212; usually from <a href="https://en.wikipedia.org/wiki/Cherepovets" target="_blank" rel="noopener">Cherepovets</a>, an industrial town situated approximately 230 miles north of Moscow. Also, it was common for Icamis to reply when Spamdot members communicated a request or complaint to Sal, and vice versa.</p>
<div id="attachment_66063" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66063" decoding="async" loading="lazy" class="wp-image-66063" src="media/a0cf08e8.ru-map-chere.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/ru-map-chere.png" alt="" width="745" height="396" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/ru-map-chere.png 939w, https://krebsonsecurity.com/wp-content/uploads/2024/01/ru-map-chere-768x408.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/ru-map-chere-782x416.png 782w" sizes="(max-width: 745px) 100vw, 745px" /><p id="caption-attachment-66063" class="wp-caption-text">Image: maps.google.com</p></div>
<p>Still, other clues suggested Icamis and Sal were two separate individuals. For starters, they frequently changed the status on their instant messenger clients at different times. Also, they each privately discussed with others having attended different universities.</p>
<p>KrebsOnSecurity began researching Icamis&#8217;s real-life identity in 2012, but failed to revisit any of that research until recently. In December 2023, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">published new details about the identity of &#8220;Rescator,&#8221;</a> a Russian cybercriminal who is thought to be closely connected to the 2013 data breach at Target.</p>
<p>That story mentioned Rescator&#8217;s real-life identity was exposed by Icamis in April 2013, as part of a lengthy farewell letter Ika wrote to Spamdot members wherein Ika said he was closing the forum and quitting the cybercrime business entirely.</p>
<p>To no one&#8217;s shock, Icamis didn&#8217;t quit the business: He simply became more quiet and circumspect about his work, which increasingly was focused on helping crime groups siphon funds from U.S. bank accounts. But the Rescator story was a reminder that 10 years worth of research on who Ika/Icamis is in real life had been completely set aside. This post is an attempt to remedy that omission.</p>
<div id="attachment_65789" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65789" decoding="async" loading="lazy" class=" wp-image-65789" src="media/6aac936a.ika-pustota-goodbye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye.png" alt="" width="750" height="307" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye.png 1692w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye-768x315.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye-1536x629.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/12/ika-pustota-goodbye-782x320.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-65789" class="wp-caption-text">The farewell post from Ika (aka Icamis), the administrator of both the BlackSEO forum and Pustota, the successor forum to Spamit/Spamdot.</p></div>
<h2>GENTLEMEN SCAMMERS</h2>
<p>Icamis and Sal offered a comprehensive package of goods and services that any aspiring or accomplished spammer would need on a day-to-day basis: Virtually unlimited bulletproof domain registration and hosting services, as well as services that helped botmasters evade spam block lists generated by anti-spam groups like <a href="https://www.spamhaus.org/statistics/spammers/" target="_blank" rel="noopener">Spamhaus.org</a>. Here&#8217;s snippet of Icamis&#8217;s ad on Spamdot from Aug. 2008, wherein he addresses forum members with the salutation, &#8220;Hello Gentlemen Scammers.&#8221;</p>
<blockquote><p>We are glad to present you our services!<br />
Many are already aware (and are our clients), but publicity is never superfluous. <img src="media/3fc8b120.1f642.png" data-original-source="https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /></p>
<p>Domains.<br />
&#8211; all major gtlds (com, net, org, info, biz)<br />
&#8211; many interesting and uninteresting cctlds<br />
&#8211; options for any topic<br />
&#8211; processing of any quantities<br />
&#8211; guarantees<br />
&#8211; exceptionally low prices for domains for white and gray schemes (including any SEO and affiliate spam )<br />
&#8211; control panel with balances and auto-registration<br />
&#8211; all services under the Ikamis brand, proven over the years;)</p>
<p>Servers.<br />
&#8211; long-term partnerships with several [data centers] in several parts of the world for any topic<br />
&#8211; your own data center (no longer in Russia ;)) for gray and white topics<br />
&#8211; any configuration and any hardware<br />
&#8211; your own IP networks (PI, not PA) and full legal support<br />
&#8211; realtime backups to neutral sites<br />
&#8211; guarantees and full responsibility for the services provided<br />
&#8211; non-standard equipment on request<br />
&#8211; our own admins to resolve any technical issues (services are free for clients)<br />
&#8211; hosting (shared and vps) is also possible</p>
<p>Non-standard and related services.<br />
&#8211; ssl certificates signed by geotrust and thawte<br />
&#8211; old domains (any year, any quantity)<br />
&#8211; beautiful domains (keyword, short, etc.)<br />
&#8211; domains with indicators (any, for SEO, etc.)<br />
&#8211; making unstable gtld domains stable<br />
&#8211; interception and hijacking of custom domains (expensive)<br />
&#8211; full domain posting via web.archive.org with restoration of native content (preliminary applications)<br />
&#8211; any updates to our panels to suit your needs upon request (our own coders)</p>
<p>All orders for the “Domains” sections and &#8220;Servers&#8221; are carried out during the day (depending on our workload).<br />
For non-standard and related services, a preliminary application is required 30 days in advance (except for ssl certificates &#8211; within 24 hours).</p></blockquote>
<p>Icamis and Sal frequently claimed that their service kept Spamhaus and other anti-spam groups several steps behind their operations. But it&#8217;s clear that those anti-spam operations had a real and painful impact on spam revenues, and Salomon was obsessed with striking back at anti-spam groups, particularly Spamhaus.</p>
<p>In 2007, Salomon collected more than $3,000 from botmasters affiliated with competing spam affiliate programs that wanted to see Spamhaus suffer, and the money was used to fund a week-long distributed denial-of-service (DDoS) attack against Spamhaus and its online infrastructure. But rather than divert their spam botnets from their normal activity and thereby decrease sales, the botmasters voted to create a new DDoS botnet by purchasing installations of DDoS malware on thousands of already-hacked PCs (at a rate of $25 per 1,000 installs).</p>
<p><span id="more-65945"></span></p>
<h2>SALOMON</h2>
<p>As an affiliate of Spamdot, Salomon used the email address <strong>ad1@safe-mail.net</strong>, and the password <strong>19871987gr</strong>. The breach tracking service <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> found the password 19871987gr was used by the email address <strong>grichishkin@gmail.com</strong>. Multiple accounts are registered to that email address under the name <strong>Alexander Valerievich Grichishkin</strong>, from Cherepovets.</p>
<p>In 2020, Grichishkin was arrested outside of Russia on a warrant for providing bulletproof hosting services to cybercriminal gangs. The U.S. government said Grichishkin and three others set up the infrastructure used by cybercriminals between 2009 to 2015 to distribute malware and attack financial institutions and victims throughout the United States.</p>
<p>Those clients included crooks using malware like <a href="https://krebsonsecurity.com/tag/zeus-trojan/" target="_blank" rel="noopener">Zeus</a>, <a href="https://krebsonsecurity.com/?s=spyeye" target="_blank" rel="noopener">SpyEye</a>, <a href="https://krebsonsecurity.com/?s=Citadel" target="_blank" rel="noopener">Citadel</a> and the <a href="https://krebsonsecurity.com/?s=blackhole+exploit+kit" target="_blank" rel="noopener">Blackhole exploit kit</a> to build botnets and steal banking credentials.</p>
<p>&#8220;The Organization and its members helped their clients to access computers without authorization, steal financial information (including banking credentials), and initiate unauthorized wire transfers from victims&#8217; financial accounts,&#8221; the government&#8217;s complaint stated.</p>
<p>Grichishkin <a href="https://www.justice.gov/opa/pr/russian-man-sentenced-providing-bulletproof-hosting-cybercriminals" target="_blank" rel="noopener">pleaded guilty</a> to conspiracy charges and was sentenced to four years in prison. He is 36 years old, has a wife and kids in Thailand, and is slated for release on February 8, 2024.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-65957" src="media/e766cc45.grichishkin-bop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/grichishkin-bop.png" alt="" width="750" height="380" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/12/grichishkin-bop.png 922w, https://krebsonsecurity.com/wp-content/uploads/2023/12/grichishkin-bop-768x389.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/12/grichishkin-bop-782x396.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<h2>ICAMIS, THE PHANTOM GRADUATE</h2>
<p>The identity of Icamis came into view when KrebsOnSecurity began focusing on clues that might connect Icamis to Cherepovets (Ika&#8217;s apparent hometown based on the Internet addresses he regularly used to access Spamdot).</p>
<p>Historic domain ownership records from <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> reveal that many of the email addresses and domains connected to Icamis invoke the name &#8220;<strong>Andrew Artz</strong>,&#8221; including <strong>icamis[.]w</strong>s, <strong>icamis[.]ru</strong>, and <strong>icamis[.]biz</strong>. Icamis <a href="https://groups.google.com/g/news.admin.net-abuse.sightings/c/yBiTl_M5mk8/m/GUAoys6sFDAJ" target="_blank" rel="noopener">promoted his services in 2003</a> &#8212; such as <strong>bulk-domains[.]info</strong> &#8212; using the email address <strong>icamis@4host.info</strong>. From one of his ads in 2005:</p>
<blockquote>
<p class="p1">Domains For Projects Advertised By Spam</p>
<p class="p1">I can register bulletproof domains for sites and projects advertised by spam(of course they must be legal). I can not provide DNS for u, only domains. The price will be:</p>
<p class="p1">65$ for domain[if u will buy less than 5 domains]</p>
<p class="p1">50$ for domain[more than 5 domains]</p>
<p class="p1">45$ for domain[more than 10 domains]</p>
<p class="p1">These prices are for domains in the .net &amp; .com zones.</p>
<p class="p1">If u want to order domains write me to: icamis@4host.info</p>
</blockquote>
<p>In 2009, an &#8220;<strong>Andrew Artz</strong>&#8221; registered at the hosting service FirstVDS.com using the email address <strong>icamis@4host.info</strong>, with a notation saying the company name attached to the account was &#8220;<strong>WMPay</strong>.&#8221; Likewise, the bulletproof domain service <strong>icamis[.]ws</strong> was registered to an Andrew Artz.</p>
<p class="p1">The domain wmpay.ru is registered to the phonetically similar name &#8220;Andrew Hertz,&#8221; at <strong>andrew@wmpay.ru</strong>. A search on &#8220;icamis.ru&#8221; in Google brings up <a href="https://web.archive.org/web/20121006061847/http://zbook.ru/book.cgi?amtek-gb-p19" target="_blank" rel="noopener">a 2003 post by him on a discussion forum</a> designed by and for students of <strong>Amtek</strong>, a secondary school in Cherepovets (Icamis was commenting from an Internet address in Cherepovets).</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-65989" src="media/df7ec563.icamis-amtek.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/icamis-amtek.png" alt="" width="749" height="73" /></p>
<p>The website <a href="https://amtek-foreva.narod.ru/ssilki.htm" target="_blank" rel="noopener">amtek-foreva-narod.ru</a> is still online, and it links to several yearbooks for Amtek graduates. It states that the yearbook for the Amtek class of 2004 is hosted at <strong>41.wmpay[.]com</strong>.</p>
<p>The yearbook photos for the Amtek class of 2004 are not indexed in the Wayback Machine at archive.org, but <a href="https://web.archive.org/web/20041009135237/http://41.wmpay.ru/group.htm" target="_blank" rel="noopener">the names and nicknames of 16 students remain</a>. However, it appears that the entry for one student &#8212; <em>the Wmpay[.]com site administrator</em> &#8212; was removed at some point.</p>
<p>In 2004, the administrator of the Amtek discussion forum &#8212; a 2003 graduate who used the handle &#8220;Grand&#8221; &#8212; observed that there were three people named Andrey who graduated from Amtek in 2004, but one of them was conspicuously absent from the yearbook at wmpay[.]ru: <strong>Andrey Skvortsov</strong>.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-65981" src="media/7a1de0ef.grand-skvortsov.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/grand-skvortsov.png" alt="" width="749" height="124" /></p>
<p>To bring this full circle, Icamis was Andrey Skvortsov, <a href="https://www.justice.gov/opa/pr/russian-man-sentenced-providing-bulletproof-hosting-cybercriminals" target="_blank" rel="noopener">the other Russian man charged alongside Grichiskin</a> (the two others who pleaded guilty to conspiracy charges were from Estonia and Lithuania). All of the defendants in that case pleaded guilty to conspiracy to engage in a <a href="https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act#:~:text=Under%20RICO%2C%20a%20person%20who,ways%20to%20an%20%22enterprise.%22" target="_blank" rel="noopener">Racketeer Influenced Corrupt Organization</a> (RICO).</p>
<p>[Author&#8217;s note: No doubt government prosecutors had their own reasons for omitting the nicknames of the defendants in their press releases, but that information sure would have saved me a lot of time and effort].</p>
<h2>SKVORTSOV AND THE JABBERZEUS CREW</h2>
<p>Skvortsov was sentenced to time served, and presumably deported. His current whereabouts are unknown and he was not reachable for comment via his known contact addresses.</p>
<p>The government says Ika and Sal&#8217;s bulletproof hosting empire provided extensive support for a highly damaging cybercrime group known as the <a href="https://krebsonsecurity.com/tag/jabberzeus/" target="_blank" rel="noopener">JabberZeus Crew</a>, which worked closely with the author of the Zeus Trojan &#8212; <strong>Evgeniy Mikhailovich Bogachev &#8212; </strong>to develop a then-advanced strain of the Zeus malware that was designed to defeat one-time codes for authentication. Bogachev is a top Russian cybercriminal with <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">a standing $3 million bounty on his head from the FBI.</a></p>
<p>The JabberZeus Crew stole money by constantly recruiting <a href="https://krebsonsecurity.com/tag/money-mules/" target="_blank" rel="noopener">money mules</a>, people in the United States and in Europe who could be enticed or tricked into forwarding money stolen from cybercrime victims. Interestingly, Icamis&#8217;s various email addresses are connected to websites for a vast network of phony technology companies that claimed they needed people with bank accounts to help pay their overseas employees.</p>
<p>Icamis used the email address <strong>tech@safe-mail.net</strong> on Spamdot, and this email address is tied to the registration records for multiple phony technology companies that were set up to recruit money mules.</p>
<p>One such site &#8212; <a href="https://web.archive.org/web/20050222005249/http://shop-4-job.com:80/cv_suntech.htm" target="_blank" rel="noopener">sun-technology[.]net</a> &#8212; advertised itself as a Hong Kong-based electronics firm that was looking for &#8220;honest, responsible and motivated people in UK, USA, AU and NZ to be Sales Representatives in your particular region and receive payments from our clients. Agent commission is 5 percent of total amount received to the personal bank account. You may use your existing bank account or open a new one for these purposes.&#8221;</p>
<p>In January 2010, KrebsOnSecurity broke the news that the JabberZeus crew <a href="https://krebsonsecurity.com/2010/01/fbi-investigating-theft-of-500000-from-ny-school-district/" target="_blank" rel="noopener">had just used money mules to steal $500,000 from tiny Duanesburg Central School District</a> in upstate New York. As part of his sentence, Skvortsov was <a href="media/76629949.duanesburg-restitution.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/duanesburg-restitution.png" target="_blank" rel="noopener">ordered to pay $497,200 in restitution</a> to the Duanesburg Central School District.</p>
<p>The JabberZeus Crew operated mainly out of the eastern Ukraine city of Donetsk, which was always pro-Russia and is now occupied by Russian forces. But when Russia invaded Ukraine in February 2022, the alleged leader of the notorious cybercrime gang &#8212; <strong>Vyacheslav Igoravich Andreev</strong> (a.ka. Penchukov) &#8212; fled his mandatory military service orders and <a href="https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-tank-arrested-in-geneva/" target="_blank" rel="noopener">was arrested in Geneva, Switzerland</a>. He is currently in federal custody awaiting trial, and is slated to be arraigned in U.S. federal court tomorrow (Jan. 9, 2024). A copy of the indictment against Andreev is <a href="media/1b8b16be.Penchukov-sevsindictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/12/Penchukov-sevsindictment.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<div id="attachment_61804" style="width: 648px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61804" decoding="async" loading="lazy" class=" wp-image-61804" src="media/ea1b4c16.tank-dj.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/tank-dj.png" alt="" width="638" height="504" /><p id="caption-attachment-61804" class="wp-caption-text">Andreev, aka &#8220;Tank,&#8221; seen here performing as a DJ in Ukraine in an undated photo from social media.</p></div>


feed_id: https://krebsonsecurity.com/?p=65312
title: Here’s Some Bitcoin: Oh, and You’ve Been Served!
uri: Here-s-Some-Bitcoin-Oh-and-You-ve-Been-Served
url: https://krebsonsecurity.com/2024/01/heres-some-bitcoin-oh-and-youve-been-served/
content:
<p>A California man who lost $100,000 in a 2021 SIM-swapping attack is suing the unknown holder of a cryptocurrency wallet that harbors his stolen funds. The case is thought to be first in which a federal court has recognized the use of information included in a bitcoin transaction &#8212; such as a link to a civil claim filed in federal court &#8212; as reasonably likely to provide notice of the lawsuit to the defendant. Experts say the development could make it easier for victims of crypto heists to recover stolen funds through the courts without having to wait years for law enforcement to take notice or help.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-47805" src="media/6cdd7528.suingyou.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/suingyou.jpg" alt="" width="691" height="456" /></p>
<p><strong>Ryan Dellone</strong>, a healthcare worker in Fresno, Calif., asserts that thieves stole his bitcoin on Dec. 14, 2021, by executing an unauthorized SIM-swap that involved an employee at his mobile phone provider who switched Dellone&#8217;s phone number over to a new device the attackers controlled.</p>
<p>Dellone says the crooks then used his phone number to break into his account at <strong>Coinbase</strong> and siphon roughly $100,000 worth of cryptocurrencies. Coinbase is also named as a defendant in the lawsuit, which alleges the company ignored multiple red flags, and that it should have detected and stopped the theft. Coinbase did not respond to requests for comment.</p>
<p>Working with experts who track the flow of funds stolen in cryptocurrency heists, Dellone&#8217;s lawyer <strong>Ethan Mora </strong>identified a bitcoin wallet that was the ultimate destination of his client&#8217;s stolen crypto. Mora says his client has since been made aware that the bitcoin address in question is embroiled in an ongoing federal investigation into a cryptocurrency theft ring.</p>
<p>Mora said it&#8217;s unclear if the bitcoin address that holds his client&#8217;s stolen money is being held by the government or by the anonymous hackers. Nevertheless, he is pursuing a novel legal strategy that allows his client to serve notice of the civil suit to that bitcoin address &#8212; and potentially win a default judgment to seize his client&#8217;s funds within &#8212; <em>without knowing the identity of his attackers or anything about the account holder.</em></p>
<p>In a civil lawsuit seeking monetary damages, a default judgment is usually entered on behalf of the plaintiff if the defendant fails to respond to the complaint within a specified time. Assuming that the cybercriminals who stole the money don&#8217;t dispute Dellone&#8217;s claim, experts say the money could be seized by cryptocurrency exchanges if the thieves ever tried to move it or spend it.</p>
<p>The U.S. courts have generally held that if you&#8217;re going to sue someone, you have to provide some kind of meaningful and timely communication about that lawsuit to the defendant in a way that is reasonably likely to provide them notice.</p>
<p>Not so long ago, you had track down your defendant and hire someone to physically serve them with a copy of the court papers. But legal experts say the courts have evolved their thinking in recent years about what constitutes meaningful service, and now allow notification via email.</p>
<p>On Dec. 14, 2023, a federal judge in the Eastern District of California granted Dellone permission to serve notice of his lawsuit directly to the suspected hackers&#8217; bitcoin address &#8212; using a short message that was attached to roughly $100 worth of bitcoin Mora sent to the address.</p>
<p>Bitcoin transactions are public record, and each transaction can be sent along with an optional short message. The message uses what&#8217;s known as an &#8220;<a href="https://cryptoapis.io/blog/34-adding-metadata-to-your-bitcoin-transactions" target="_blank" rel="noopener">OP RETURN</a>,&#8221; or an instruction of the Bitcoin scripting language that allows users to attach metadata to a transaction &#8212; and thus save it on the blockchain.</p>
<p>In the $100 bitcoin transaction Mora sent to the disputed bitcoin address, the OP RETURN message read: &#8220;OSERVICE &#8211; SUMMONS, COMPLAINT U.S. Dist. E.D. Cal. LINK: <a href="https://t.ly/123cv01408_service">t.ly/123cv01408_service</a>,&#8221; which is a short link to a copy of the lawsuit hosted on Google Drive.</p>
<p>&#8220;The courts are adapting to the new style of service of process,&#8221; said <strong>Mark Rasch</strong>, a former federal prosecutor at the U.S. Department of Justice. &#8220;And that&#8217;s helpful and useful and necessary.&#8221;<span id="more-65312"></span></p>
<p>Rasch said Mora&#8217;s strategy could force the government to divulge information about their case, or else explain to a judge why the plaintiff shouldn&#8217;t be able to recover their stolen funds without further delay. Rasch said it could be that Dellone&#8217;s stolen crypto was seized as part of a government asset forfeiture, but that either way there is no reason Uncle Sam should hold some cybercrime victims&#8217; life savings indefinitely.</p>
<p>&#8220;The government doesn&#8217;t need the crypto as evidence, but in a forfeiture action the money goes to the government,&#8221; Rasch said. &#8220;But it was never the government&#8217;s money, and that doesn&#8217;t help the victim. The government should be providing information to the victims of cryptocurrency theft so that their attorneys can go get the money back themselves.&#8221;</p>
<p><strong>Nick Bax</strong> is a security researcher who specializes in tracing the labyrinthine activity of criminals trying to use cryptocurrency exchanges and other financial instruments to launder the proceeds of cybercrime. Bax said Mora&#8217; method could allow more victims to stake legitimate legal claims to their stolen funds.</p>
<p>&#8220;If you get a default judgment against a bitcoin address, for example, and then down the road that bitcoin gets sent to an exchange that complies with or abides by U.S. court orders, then it&#8217;s yours,&#8221; Bax said. &#8220;I&#8217;ve seen funds with a court order on them get frozen by the exchanges that decided it made sense to comply with orders from a U.S. federal court.&#8221;</p>
<p>Bax&#8217;s research was featured in <a href="https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/" target="_blank" rel="noopener">a Sept. 2023 story here</a> about how experts now believe it&#8217;s likely hackers are cracking open some of the password vaults stolen in the 2022 data breach at LastPass.</p>
<p>&#8220;I&#8217;ve talked to a lot victims who have had life-changing amounts of money being seized and would like that money back,&#8221; Bax said. &#8220;A big goal here is just making civil cases more efficient. Because then people can help themselves and they don&#8217;t need to rely solely on law enforcement with its limited resources. And that&#8217;s really the goal: To scale this and make it economically viable.&#8221;</p>
<p>While Dellone&#8217;s lawsuit may be the first time anyone has obtained approval from a federal judge to use bitcoin to notify another party of a civil action, the technique has been used in several recent unrelated cases involving other cryptocurrencies, including Ethereum and NFTs.</p>
<p>The law firm DLAPiper <a href="https://www.dlapiper.com/en/insights/publications/2022/12/florida-court-allows-service-of-lawsuit-crypto-scammers" target="_blank" rel="noopener">writes</a> that in November 2022, the U.S. District Court for the Southern District of Florida &#8220;authorized service of a lawsuit seeking the recovery of stolen digital assets by way of a non-fungible token or NFT containing the text of the complaint and summons, as well as a hyperlink to a website created by the plaintiffs containing all pleadings and orders in the action.&#8221;</p>
<p>In approving Dellone&#8217;s request for service via bitcoin transaction, the judge overseeing the case cited a recent New York Superior Court ruling in a John Doe case brought by victims seeking to unmask the crooks behind a $1.3 million cyberheist.</p>
<p>In the New York case, the state trial court found it was acceptable for the plaintiffs to serve notice of the suit via cryptocurrency transactions because the defendants regularly used the Blockchain address to which the tokens were sent, and had recently done so. Also, the New York court found that because the account in question contained a significant sum of money, it was unlikely to be abandoned or forgotten.</p>
<p>&#8220;Thus the court inferred the defendants were likely to access the account in the future,&#8221; wrote <strong>Judge Helena M. March-Kuchta</strong>, for the Eastern District of California, summarizing the New York case. &#8220;Finally, the plaintiff had no alternative means of contacting these unknown defendants.&#8221;</p>
<p>Experts say regardless of the reason for a cryptocurrency theft or loss &#8212; whether it&#8217;s from a romance scam or a straight-up digital mugging &#8212; it&#8217;s important for victims to file an official report both with their local police and with the FBI&#8217;s <strong>Internet Crime Complaint Center</strong> (<a href="https://www.ic3.gov" target="_blank" rel="noopener">ic3.gov</a>). The IC3 collects reports on cybercrime and sometimes bundles victim reports into cases for DOJ/FBI prosecutors and investigators.</p>
<p>The hard truth is that most victims will never see their stolen funds again. But sometimes federal investigators win minor victories and manage to seize or freeze crypto assets that are known to be associated with specific crimes and criminals. In those cases, the government will eventually make an effort to find, contact and in some cases remunerate known victims.</p>
<p>It might take many years for this process to unfold. But if and when they do make that effort, federal investigators are likely to focus their energies and attention responding to victims who staked a claim and can support it with documentation.</p>
<p>But have no illusions that any of this is likely to happen in a timeframe that is meaningful to victims in the short run. For example, in 2013 the U.S. government <a href="https://krebsonsecurity.com/2013/05/u-s-government-seizes-libertyreserve-com/" target="_blank" rel="noopener">seized the assets of the virtual currency Liberty Reserve</a>, massively disrupting a major vehicle for laundering the proceeds of cybercrime and other illegal activities.</p>
<p>When the government offered remuneration to Liberty Reserve account holders who wished to make a financial loss claim and supply supporting documentation, KrebsOnSecurity filed a claim. There wasn&#8217;t money much in my Liberty Reserve account; I simply wanted to know how long it would take for federal investigators to follow up on my claim, or indeed if they would at all.</p>
<p>In 2020 KrebsOnSecurity was <a href="https://krebsonsecurity.com/2020/02/a-light-at-the-end-of-liberty-reserves-demise/" target="_blank" rel="noopener">contacted by an investigator with the U.S. Internal Revenue Service</a> (IRS) who was seeking to discuss my claim. The investigator said they would have called sooner, but that it had taken that long for the IRS to gain legal access to the funds seized in the 2013 Liberty Reserve takedown.</p>


feed_id: https://krebsonsecurity.com/?p=66130
title: E-Crime Rapper ‘Punchmade Dev’ Debuts Card Shop
uri: E-Crime-Rapper-Punchmade-Dev-Debuts-Card-Shop
url: https://krebsonsecurity.com/2024/01/e-crime-rapper-punchmade-dev-debuts-card-shop/
content:
<p>The rapper and social media personality <strong>Punchmade Dev</strong> is perhaps best known for his flashy videos singing the praises of a cybercrime lifestyle. With memorable hits such as &#8220;Internet Swiping&#8221; and &#8220;Million Dollar Criminal&#8221; earning millions of views, Punchmade has leveraged his considerable following to peddle tutorials on how to commit financial crimes online. But until recently, there wasn&#8217;t much to support a conclusion that Punchmade was actually doing the cybercrime things he promotes in his songs.</p>
<div id="attachment_66136" style="width: 630px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66136" decoding="async" class="wp-image-66136 size-full" src="media/e59ed402.punchmadecardskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadecardskim.png" alt="" width="620" height="822" /><p id="caption-attachment-66136" class="wp-caption-text">Images from Punchmade Dev&#8217;s Twitter/X account show him displaying bags of cash and wearing a functional diamond-crusted payment card skimmer.</p></div>
<p>Punchmade Dev&#8217;s most controversial mix &#8212; a rap called &#8220;Wire Fraud Tutorial&#8221; &#8212; was <a href="https://www.complex.com/music/a/tracewilliamcowen/punchmade-dev-wire-fraud-tutorial-removed-youtube" target="_blank" rel="noopener">taken down by Youtube last summer</a> for violating the site&#8217;s rules. Punchmade shared on social media that the video&#8217;s removal was prompted by YouTube receiving a legal process request from law enforcement officials.</p>
<p>The 24-year-old rapper told reporters he wasn&#8217;t instructing people how to conduct wire fraud, but instead informing his fans on how to avoid being victims of wire fraud. However, this is difficult to discern from listening to the song, which sounds very much like a step-by-step tutorial on how to commit wire fraud.</p>
<p>&#8220;Listen up, I&#8217;m finna show y&#8217;all how to hit a bank,&#8221; Wire Fraud Tutorial begins. &#8220;Just pay attention, this is a quick way to jug in any state. First you wanna get a bank log from a trusted site. Do your research because the information must be right.&#8221;</p>
<p>And even though we&#8217;re talking about an individual who regularly appears in videos wearing a half-million dollars worth of custom jewelry draped around his arm and neck (including the functional diamond-encrusted payment card skimming device pictured above), there&#8217;s never been much evidence that Punchmade was actually involved in committing cybercrimes himself. Even his most vocal critics acknowledged that the whole persona could just be savvy marketing.</p>
<p>That changed recently when Punchmade&#8217;s various video and social media accounts began promoting a new web shop that is selling stolen payment cards and identity data, as well as hacked financial accounts and software for producing counterfeit checks.</p>
<div id="attachment_66135" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66135" decoding="async" loading="lazy" class="wp-image-66135" src="media/e1240061.punchmadeshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop.png" alt="Punchmade Dev's shop." width="749" height="477" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop.png 1260w, https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop-768x489.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop-782x498.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66135" class="wp-caption-text">Punchmade Dev&#8217;s shop.</p></div>
<p>The official <a href="https://www.instagram.com/punchmadedev" target="_blank" rel="noopener">Punchmadedev account on Instagram</a> links to many of the aforementioned rap videos and tutorials on cybercriming, as well as to Punchmadedev&#8217;s other profiles and websites. Among them is mainpage[.]me/punchmade, which includes the following information for &#8220;<strong>Punchmade Empire ®</strong>&#8221;</p>
<p>-212,961 subscribers</p>
<p>#1 source on Telegram</p>
<p>Contact: @whopunchmade</p>
<p>24/7 shop: https://punchmade[.]atshop[.]io</p>
<p>Visiting that @whopunchmade Telegram channel shows this user is promoting <strong>punchmade[.]atshop[.]io</strong>, which is currently selling hacked bank accounts and payment cards with high balances.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66134" src="media/be3926b1.whopunch-offerings.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/whopunch-offerings.png" alt="" width="744" height="691" /></p>
<p>Clicking &#8220;purchase&#8221; on the C@sh App offering, for example, shows that for $80 the buyer will receive logins to Cash App accounts with balances between $3,000 and $5,000. &#8220;If you buy this item you&#8217;ll get my full support on discord/telegram if there is a problem!,&#8221; the site promises. Purchases can be made in cryptocurrencies, and checking out prompts one to continue payment at Coinbase.com.</p>
<p>Another item for sale, &#8220;Fullz + Linkable CC,&#8221; promises &#8220;ID Front + Back, SSN with 700+ Credit Score, and Linkable CC&#8221; or credit card. That also can be had for $80 in crypto.<span id="more-66130"></span></p>
<h2>WHO IS PUNCHMADE DEV?</h2>
<p>Punchmade has fashioned his public persona around a collection of custom-made, diamond-covered necklaces that are as outlandish and gaudy as they are revelatory. My favorite shot from one of Punchmade&#8217;s videos features at least three of these monstrosities: One appears to be a boring old diamond and gold covered bitcoin, but the other two necklaces tell us something about where Punchmade is from:</p>
<div id="attachment_66132" style="width: 648px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66132" decoding="async" loading="lazy" class="size-full wp-image-66132" src="media/4f0cf083.punchmadeneck.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeneck.png" alt="" width="638" height="668" /><p id="caption-attachment-66132" class="wp-caption-text">Notice the University of Kentucky logo, and the Lexington, Ky skyline.</p></div>
<p>One of them includes the logo and mascot of the <strong>University of Kentucky</strong>. The other, an enormous diamond studded skyline, appears to have been designed based on the skyline in Lexington, Ky:</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-66133" src="media/75cf059d.lexingskyline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/lexingskyline.png" alt="" width="674" height="329" /></p>
<p>The &#8220;About&#8221; page on <a href="https://open.spotify.com/artist/4YIj5zh0m0Qp2zIC01bfny" target="_blank" rel="noopener">Punchmade Dev&#8217;s Spotify profile</a> describes him as &#8220;an American artist, rapper, musician, producer, director, entrepreneur, actor and investor.&#8221; &#8220;Punchmade Dev is best known for his creative ways to use technology, video gaming, and social media to build a fan base,&#8221; the profile continues.</p>
<p>The profile explains that he launched his own record label in 2021 called Punchmade Records, where he produces his own instrumentals and edits his own music videos.</p>
<p>A search on companies that include the name &#8220;punchmade&#8221; at the website of the Kentucky Secretary of State brings up just one record: <strong>OBN Group LLC</strong>, in Lexington, Ky. This November 2021 record includes a Certificate of Assumed Name, which shows that <strong>Punchmade LLC</strong> is the assumed name of OBN Group LLC.</p>
<p>The president of OBN Group LLC is listed as <strong>Devon Turner</strong>. A search on the Secretary of State website for other businesses tied to Devon Turner reveals just one other record: A now-defunct entity called <strong>DevTakeFlightBeats Inc</strong>.</p>
<p>The breach tracking service <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> finds that Devon Turner from Lexington, Ky. used the email address <strong>obndevpayments@gmail.com</strong>. A lookup on this email at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> shows it was used to register the domain <strong>foreverpunchmade[.]com</strong>, which is registered to a Devon Turner in Lexington, Ky. A copy of this site at archive.org indicates it once sold Punchmade <a href="https://web.archive.org/web/20231030160708/https://www.foreverpunchmade.com/" target="_blank" rel="noopener">Dev-branded t-shirts and other merchandise</a>.</p>
<p>Mr. Turner did not respond to multiple requests for comment.</p>
<p>Searching online for Devon Turner and &#8220;Punchmade&#8221; brings up <a href="https://www.youtube.com/watch?v=dhEpzZYgnow" target="_blank" rel="noopener">a video from @brainjuiceofficial</a>, a YouTube channel that focuses on social media celebrities. @Brainjuiceofficial says Turner was born in October 2000, the oldest child of a single mother of five whose husband was not in the picture.</p>
<div id="attachment_66142" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66142" decoding="async" loading="lazy" class=" wp-image-66142" src="media/394811f7.devonturner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner.png" alt="" width="750" height="590" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner.png 827w, https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner-768x605.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner-782x616.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66142" class="wp-caption-text">Devon Turner, a.k.a. &#8220;Punchmade Dev,&#8221; in an undated photo.</p></div>
<p>The video says the six-foot five Turner played basketball, track and football in high school, but that he gradually became obsessed with playing the video game <a href="https://en.wikipedia.org/wiki/NBA_2K17" target="_blank" rel="noopener">NBA 2K17</a> and building a following of people watching him play the game competitively online.</p>
<p>According to this brief documentary, Turner previously streamed his NBA 2K17 videos on a YouTube channel called DevTakeFlight, although he originally went by the nickname <strong>OBN Dev</strong>.</p>
<p>&#8220;Things may eventually catch up to Devon if he isn&#8217;t careful,&#8221; @Brainjuiceofficial observed, noting that Turner has been shot at before, and also robbed at an ATM while flexing a bunch of cash for a picture and wearing $500k in jewelry. &#8220;Although you have a lot of people that are into what you do, there are a lot of people waiting for you to slip up.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=65740
title: Canadian Man Stuck in Triangle of E-Commerce Fraud
uri: Canadian-Man-Stuck-in-Triangle-of-E-Commerce-Fraud
url: https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/
content:
<p>A Canadian man who says he&#8217;s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve &#8220;triangulation fraud,&#8221; which occurs when a consumer purchases something online &#8212; from a seller on <strong>Amazon</strong> or <strong>eBay</strong>, for example &#8212; but the seller doesn&#8217;t actually own the item for sale. Instead, the seller purchases the item from an online retailer using stolen payment card data. In this scam, the unwitting buyer pays the scammer and receives what they ordered, and very often the only party left to dispute the transaction is the owner of the stolen payment card.</p>
<div id="attachment_32692" style="width: 647px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-32692" decoding="async" class="size-full wp-image-32692" src="media/df24e2df.triangulationfraud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/11/triangulationfraud.png" alt="" width="637" height="349" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/11/triangulationfraud.png 637w, https://krebsonsecurity.com/wp-content/uploads/2015/11/triangulationfraud-580x318.png 580w" sizes="(max-width: 637px) 100vw, 637px" /><p id="caption-attachment-32692" class="wp-caption-text">Triangulation fraud. Image: eBay Enterprise.</p></div>
<p><strong>Timothy Barker</strong>, 56, was until recently a Band Manager at <a href="https://www.duncansfirstnation.com/" target="_blank" rel="noopener">Duncan&#8217;s First Nation</a>, a First Nation in northwestern Alberta, Canada. A <a href="media/c49b90e6.Band_Manager.pdf" data-original-source="https://www.fnha.ca/Documents/Band_Manager.pdf" target="_blank" rel="noopener">Band Manager</a> is responsible for overseeing the delivery of all Band programs, including community health services, education, housing, social assistance, and administration.</p>
<p>Barker told KrebsOnSecurity that during the week of March 31, 2023 he and the director of the Band&#8217;s daycare program discussed the need to purchase items for the community before the program&#8217;s budget expired for the year.</p>
<p>&#8220;There was a rush to purchase items on the Fiscal Year 2023 timeline as the year ended on March 31,&#8221; Barker recalled.</p>
<p>Barker said he bought seven &#8220;Step2 All Around Playtime Patio with Canopy&#8221; sets from a seller on <strong>Amazon.ca</strong>, using his payment card on file to pay nearly $2,000 for the items.</p>
<p>On the morning of April 7, Barker awoke to a series of nasty messages and voice calls on Facebook from an Ontario woman he&#8217;d never met. She demanded to know why he&#8217;d hacked her <strong>Walmart</strong> account and used it to buy things that were being shipped to his residence. Barker shared a follow-up message from the woman, who later apologized for losing her temper.</p>
<div id="attachment_66119" style="width: 319px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66119" decoding="async" loading="lazy" class="size-full wp-image-66119" src="media/e54a7141.tri-fbmsg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/tri-fbmsg.png" alt="" width="309" height="603" /><p id="caption-attachment-66119" class="wp-caption-text">One of several messages from the Ontario woman whose Walmart account was used to purchase the goods that Barker ordered from Amazon.</p></div>
<p>&#8220;If this is not the person who did this to me, I&#8217;m sorry, I&#8217;m pissed,&#8221; the lady from Ontario said. &#8220;This order is being delivered April 14th to the address above. If not you, then someone who has the same name. Now I feel foolish.&#8221;</p>
<p>On April 12, 2023, before the Amazon purchases had even arrived at his home, Barker received a call from an investigator with the <strong>Royal Canadian Mounted Police</strong> (RCMP), who said Barker urgently needed to come down to the local RCMP office for an interview related to &#8220;an investigation.&#8221; Barker said the officer wouldn&#8217;t elaborate at the time on the nature of the investigation, and that he told the officer he was in Halifax for several days but could meet after his return home.</p>
<p>According to Barker, the investigator visited his home anyway the following day and began questioning his wife, asking about his whereabouts, his work, and when he might return home.</p>
<p>On April 14, six boxes arrived to partially fulfill his Amazon order; another box was delayed, and the Amazon.ca seller he&#8217;d purchased from said the remaining box was expected to ship the following week. Barker said he was confused because all six boxes came from Walmart instead of Amazon, and the shipping labels had his name and address on them but carried a contact phone number in Mexico.</p>
<p>Three days later, the investigator called again, demanding he submit to an interview.</p>
<p>&#8220;He then asked where my wife was and what her name is,&#8221; Barker said. &#8220;He wanted to know her itinerary for the day. I am now alarmed and frightened &#8212; this doesn&#8217;t feel right.&#8221;</p>
<p>Barker said he inquired with a local attorney about a consultation, but that the RCMP investigator showed up at his house before he could speak to the lawyer. The investigator began taking pictures of the boxes from his Amazon order.</p>
<p>&#8220;The [investigator] derisively asked why would anyone order so many play sets?&#8221; Barker said. &#8220;I started to give the very logical answer that we are helping families improve their children’s home life and learning for toddlers when he cut me off and gave the little speech about giving a statement after my arrest. He finally told me that he believes that I used someone&#8217;s credit card in Ontario to purchase the Walmart products.&#8221;</p>
<p>Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon. But on April 21, the investigator called again to say he was coming to arrest Barker for theft.</p>
<p>&#8220;He said that if I was home at five o&#8217;clock then he would serve the papers at the house and it would go easy and I wouldn’t have to go to the station,&#8221; Barker recalled. &#8220;If I wasn’t home, then he would send a search team to locate me and drag me to the station. He said he would kick the door down if I didn’t answer my phone. He said he had every right to break our door down.&#8221;</p>
<p>Barker said he briefly conferred with an attorney about how to handle the arrest. Later that evening, the RCMP arrived with five squad cars and six officers.</p>
<p>&#8220;I asked if handcuffs were necessary – there is no danger of violence,&#8221; Barker said. &#8220;I was going to cooperate. His response was to turn me around and cuff me. He walked me outside and stood me beside the car for a full 4 or 5 minutes in full view of all the neighbors.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter  wp-image-66160" src="media/228dbcb0.barker-k-div.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/barker-k-div.png" alt="" width="750" height="494" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/barker-k-div.png 879w, https://krebsonsecurity.com/wp-content/uploads/2024/01/barker-k-div-768x506.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/barker-k-div-782x515.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Barker believes he and the Ontario woman are both victims of triangulation fraud, and that someone likely hacked the Ontario woman&#8217;s Walmart account and added his name and address as a recipient.</p>
<p>But he says he has since lost his job as a result of the arrest, and now he can&#8217;t find new employment because he has a criminal record. Barker&#8217;s former employer &#8212; Duncan&#8217;s First Nation &#8212; did not respond to requests for comment.</p>
<p>&#8220;In Canada, a criminal record is not a record of conviction, it&#8217;s a record of charges and that&#8217;s why I can&#8217;t work now,&#8221; Barker said. &#8220;Potential employers never find out what the nature of it is, they just find out that I have a criminal arrest record.&#8221;<span id="more-65740"></span></p>
<p>Barker said that right after his arrest, the RCMP called the Ontario woman and told her they&#8217;d solved the crime and arrested the perpetrator.</p>
<p>&#8220;They even told her my employer had put me on administrative leave,&#8221; he said. &#8220;Surely, they&#8217;re not allowed to do that.&#8221;</p>
<p>Contacted by KrebsOnSecurity, the woman whose Walmart account was used to fraudulently purchase the child play sets said she&#8217;s not convinced this was a case of triangulation fraud. She declined to elaborate on why she believed this, other than to say the police told her Barker was a bad guy.</p>
<p>&#8220;I don&#8217;t think triangulation fraud was used in this case,&#8221; she said. &#8220;My actual Walmart.ca account was hacked and an order was placed on my account, using my credit card. The only thing Mr. Barker did was to order the item to be delivered to his address in Alberta.&#8221;</p>
<p>Barker shared with this author all of the documentation he gave to the RCMP, including screenshots of his Amazon.ca account showing that the items in dispute were sold by a seller named &#8220;<strong>Adavio</strong>,&#8221; and that the merchant behind this name was based in Turkey.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66122" src="media/e4cb0a33.adavio-convo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/adavio-convo.png" alt="" width="751" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/adavio-convo.png 954w, https://krebsonsecurity.com/wp-content/uploads/2024/01/adavio-convo-768x449.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/adavio-convo-782x457.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>That <a href="https://www.amazon.ca/sp?seller=A2H83L9DLFWTSS&amp;marketplaceID=A2EUQ1WTGCTBG2" target="_blank" rel="noopener">Adavio account</a> belongs to a young computer engineering student and &#8220;SEO expert&#8221; based in Adana, Turkey who did not respond to requests for comment.</p>
<p>Amazon.ca said it conducted an investigation and found that Mr. Barker never filed a complaint about the seller or transaction in question. The company noted that Adavio currently has a feedback rating of 4.5 stars out of 5.</p>
<p>&#8220;Amazon works hard to provide customers with a great experience and it&#8217;s our commitment to go above and beyond to make things right for customers,&#8221; Amazon.ca said in a written statement. &#8220;If a customer has an issue with an order, they may flag to Amazon through our <a href="http://www.amazon.ca/contact-us" target="_blank" rel="noopener">Customer Service</a> page.&#8221;</p>
<p>Barker said when he went to file a complaint with Amazon last year he could no longer find the Adavio account on the website, and that the site didn&#8217;t have a category for the type of complaint he wanted to file.</p>
<p>When he first approached KrebsOnSecurity about his plight last summer, Barker said he didn&#8217;t want any media attention to derail the chances of having his day in court, and confronting the RCMP investigator with evidence proving that he was being wrongfully prosecuted and maligned.</p>
<p>But a week before his court date arrived at the end of November 2023, prosecutors announced the charges against him would be stayed, meaning they had no immediate plans to prosecute the case further but that the investigation could still be reopened at some point in the future.</p>
<p>The RCMP declined to comment for this story, other than to confirm they had issued a stay of proceedings in the case.</p>
<p>Barker says the stay has left him in legal limbo &#8212; denying him the ability to clear his name, while giving the RCMP a free pass for a botched investigation. He says he has considered suing the investigating officer for defamation, but has been told by his attorney that the bar for success in such cases against the government is extremely high.</p>
<p>&#8220;I&#8217;m a 56-year-old law-abiding citizen, and I haven&#8217;t broken any laws,&#8221; Barker said, wondering aloud who would be stupid enough to use someone else&#8217;s credit card and have the stolen items shipped directly to their home.</p>
<p>&#8220;Their putting a stay on the proceedings without giving any evidence or explanation allows them to cover up bad police work,&#8221; he said. &#8220;It&#8217;s all so stupid.&#8221;</p>
<p>Triangulation fraud is hardly a new thing. KrebsOnSecurity first wrote about it <a href="https://krebsonsecurity.com/2015/11/how-carders-can-use-ebay-as-a-virtual-atm/" target="_blank" rel="noopener">from an e-commerce vendor&#8217;s perspective in 2015</a>, but the scam predates that story by many years and is now a well-understood problem. The Canadian authorities should either let Mr. Barker have his day in court, or drop the charges altogether.</p>


feed_id: https://krebsonsecurity.com/?p=66169
title: Using Google Search to Find Software Can Be Risky
uri: Using-Google-Search-to-Find-Software-Can-Be-Risky
url: https://krebsonsecurity.com/2024/01/using-google-search-to-find-software-can-be-risky/
content:
<p><strong>Google</strong> continues to struggle with cybercriminals running malicious ads on its search platform to trick people into downloading booby-trapped copies of popular free software applications. The malicious ads, which appear above organic search results and often precede links to legitimate sources of the same software, can make searching for software on Google a dicey affair.</p>
<p>Google says keeping users safe is a top priority, and that the company has a team of thousands working around the clock to create and enforce their abuse policies. And by most accounts, the threat from bad ads leading to backdoored software has subsided significantly <a href="https://arstechnica.com/information-technology/2023/02/until-further-notice-think-twice-before-using-google-to-download-software/" target="_blank" rel="noopener">compared to a year ago</a>.</p>
<p>But cybercrooks are constantly figuring out ingenious ways to fly beneath Google&#8217;s anti-abuse radar, and new examples of bad ads leading to malware are still too common.</p>
<p>For example, a Google search earlier this week for the free graphic design program <strong>FreeCAD</strong> produced the following result, which shows that a &#8220;Sponsored&#8221; ad at the top of the search results is advertising the software available from freecad-us[.]org. Although this website claims to be the official FreeCAD website, that honor belongs to the result directly below &#8212; the legitimate freecad.org.</p>
<p><img decoding="async" class="aligncenter wp-image-66174" src="media/df43a6ae.freecadad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad.png" alt="" width="757" height="537" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad.png 863w, https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad-768x545.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad-782x555.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad-100x70.png 100w" sizes="(max-width: 757px) 100vw, 757px" /></p>
<p>How do we know freecad-us[.]org is malicious? A review at <strong>DomainTools.com</strong> show this domain is the newest (registered Jan. 19, 2024) of more than 200 domains at the Internet address <strong>93.190.143[.]252</strong> that are confusingly similar to popular software titles, including <strong>dashlane-project[.]com</strong>, <strong>filezillasoft[.]com</strong>, <strong>keepermanager[.]com</strong>, and <strong>libreofficeproject[.]com</strong>.</p>
<p>Some of the domains at this Netherlands host appear to be little more than software review websites that steal content from established information sources in the IT world, including <strong>Gartner</strong>, <strong>PCWorld</strong>, <strong>Slashdot</strong> and <strong>TechRadar</strong>.</p>
<p>Other domains at 93.190.143[.]252 do serve actual software downloads, but none of them are likely to be malicious if one visits the sites through direct navigation. If one visits <strong>openai-project[.]org</strong> and downloads a copy of the popular Windows desktop management application <strong>Rainmeter</strong>, for example, the file that is downloaded has the same exact file signature as the real Rainmeter installer available from rainmeter.com.</p>
<p>But this is only a ruse, says <strong>Tom Hegel</strong>, principal threat researcher at the security firm <strong>Sentinel One</strong>. Hegel has been tracking these malicious domains for more than a year, and he said the seemingly benign software download sites will periodically turn evil, swapping out legitimate copies of popular software titles with backdoored versions that will allow cybercriminals to remotely commander the systems.</p>
<p>&#8220;They&#8217;re using automation to pull in fake content, and they&#8217;re rotating in and out of hosting malware,&#8221; Hegel said, noting that the malicious downloads may only be offered to visitors who come from specific geographic locations, like the United States. &#8220;In the malicious ad campaigns we&#8217;ve seen tied to this group, they would wait until the domains gain legitimacy on the search engines, and then flip the page for a day or so and then flip back.&#8221;</p>
<p>In February 2023, Hegel <a href="https://www.sentinelone.com/labs/malvirt-net-virtualization-thrives-in-malvertising-attacks/" target="_blank" rel="noopener">co-authored a report</a> on this same network, which Sentinel One has dubbed <strong>MalVirt </strong>(a play on &#8220;malvertising&#8221;). They concluded that the surge in malicious ads spoofing various software products was directly responsible for a surge in malware infections from infostealer trojans like <strong>IcedID</strong>, <strong>Redline Stealer</strong>, <strong>Formbook</strong> and <strong>AuroraStealer</strong>.<span id="more-66169"></span></p>
<p>Hegel noted that the spike in malicious software-themed ads came not long after Microsoft <a href="https://techcrunch.com/2022/07/22/microsoft-office-macros-blocked-default/?guccounter=1&amp;guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&amp;guce_referrer_sig=AQAAAEKr4R6wZw5XUbrv_xvjmVkpsEf9UvwgV8lwVNi1nqV1po-Cl6MF9o0VpTr2dEogYWi3BRlp54CPBRPvfxnmXSq_4vcFaeZTAY2ZiC_wFAvD1Ui1A6eYhnhbcZrk_Zf2GdErhA0AwnygyxGK10oipqRf1vF4NDTfeASLMGg_idWf" target="_blank" rel="noopener">started blocking by default Office macros</a> in documents downloaded from the Internet. He said the volume of the current malicious ad campaigns from this group appears to be relatively low compared to a year ago.</p>
<p>&#8220;It appears to be same campaign continuing,&#8221; Hegel said. &#8220;Last January, every Google search for &#8216;Autocad&#8217; led to something bad. Now, it&#8217;s like they&#8217;re paying Google to get one out of every dozen of searches. My guess it&#8217;s still continuing because of the up-and-down [of the] domains hosting malware and then looking legitimate.&#8221;</p>
<p>Several of the websites at this Netherlands host (93.190.143[.]252) are currently blocked by Google&#8217;s Safebrowsing technology, and labeled with a conspicuous red warning saying the website will try to foist malware on visitors who ignore the warning and continue.</p>
<p>But it remains a mystery why Google has not similarly blocked more the 240+ other domains at this same host, or else removed them from its search index entirely. Especially considering there is nothing else but these domains hosted at that Netherlands IP address, and because they have all remained at that address for the past year.</p>
<p>In response to questions from KrebsOnSecurity, Google said maintaining a safe ads ecosystem and keeping malware off of its platforms is a priority across Google.</p>
<p>&#8220;Bad actors often employ sophisticated measures to conceal their identities and evade our policies and enforcement, sometimes showing Google one thing and users something else,&#8221; Google said in a written statement. &#8220;We’ve reviewed the ads in question, removed those that violated our policies, and suspended the associated accounts. We’ll continue to monitor and apply our protections.”</p>
<p>Google says it removed 5.2 billion ads in 2022, and restricted more than 4.3 billion ads and suspended over 6.7 million advertiser accounts. The company&#8217;s <a href="media/a8e6cf29.2022_google_ads_safety_report.pdf" data-original-source="https://services.google.com/fh/files/misc/2022_google_ads_safety_report.pdf" target="_blank" rel="noopener">latest ad safety report</a> says Google in 2022 blocked or removed 1.36 billion advertisements for violating its abuse policies.</p>
<p>Some of the domains referenced in this story were included in Sentinel One&#8217;s February 2023 report, but dozens more have been added since, such as those spoofing the official download sites for <strong>Corel Draw</strong>, <strong>Github Desktop</strong>, <strong>Roboform</strong> and <strong>Teamviewer</strong>.</p>
<p><a href="https://forum.freecad.org/viewtopic.php?t=82229" target="_blank" rel="noopener">This October 2023 report</a> on the FreeCAD user forum came from a user who reported downloading a copy of the software from freecadsoft[.]com after seeing the site promoted at the top of a Google search result for &#8220;freecad.&#8221; Almost a month later, another FreeCAD user reported getting stung by the same scam.</p>
<p>&#8220;This got me,&#8221; FreeCAD forum user &#8220;Matterform&#8221; wrote on Nov. 19, 2023. &#8220;Please leave a report with Google so it can flag it. They paid Google for sponsored posts.&#8221;</p>
<p>Sentinel One&#8217;s report didn&#8217;t delve into the &#8220;who&#8221; behind this ongoing MalVirt campaign, and there are precious few clues that point to attribution. All of the domains in question were registered through <strong>webnic.cc</strong>, and several of them display a placeholder page saying the site is ready for content. Viewing the HTML source of these placeholder pages shows many of the hidden comments in the code are in Cyrillic.</p>
<p>Trying to track the crooks using Google&#8217;s Ad Transparency tools didn&#8217;t lead far. The ad transparency record for the malicious ad featuring freecad-us[.]org (in the screenshot above) shows that the advertising account used to pay for the ad has only run one previous ad through Google search: It advertised a wedding photography website in New Zealand.</p>
<p>The apparent owner of that photography website did not respond to requests for comment, but it&#8217;s also likely his Google advertising account was hacked and used to run these malicious ads.</p>


feed_id: https://krebsonsecurity.com/?p=66177
title: Who is Alleged Medibank Hacker Aleksandr Ermakov?
uri: Who-is-Alleged-Medibank-Hacker-Aleksandr-Ermakov
url: https://krebsonsecurity.com/2024/01/who-is-alleged-medibank-hacker-aleksandr-ermakov/
content:
<p>Authorities in Australia, the United Kingdom and the United States this week levied financial sanctions against a Russian man accused of stealing data on nearly 10 million customers of the Australian health insurance giant <strong>Medibank</strong>. 33-year-old <strong>Aleksandr Ermakov</strong> allegedly stole and leaked the Medibank data while working with one of Russia&#8217;s most destructive ransomware groups, but little more is shared about the accused. Here&#8217;s a closer look at the activities of Mr. Ermakov&#8217;s alleged hacker handles.</p>
<div id="attachment_66194" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66194" decoding="async" class=" wp-image-66194" src="media/daea492c.ermagerd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/ermagerd.png" alt="" width="750" height="300" /><p id="caption-attachment-66194" class="wp-caption-text">Aleksandr Ermakov, 33, of Russia. Image: Australian Department of Foreign Affairs and Trade.</p></div>
<p>The allegations against Ermakov mark the first time Australia has sanctioned a cybercriminal. The documents released by the Australian government included multiple photos of Mr. Ermakov, and it was clear they wanted to send a message that this was personal.</p>
<p>It&#8217;s not hard to see why. The attackers who broke into Medibank in October 2022 stole 9.7 million records on current and former Medibank customers. When the company refused to pay a $10 million ransom demand, the hackers selectively leaked highly sensitive health records, including those tied to abortions, HIV and alcohol abuse.</p>
<p>The U.S. government says Ermakov and the other actors behind the Medibank hack are believed to be linked to the Russia-backed cybercrime gang <a href="https://krebsonsecurity.com/tag/revil/" target="_blank" rel="noopener"><strong>REvil</strong></a>.</p>
<p>&#8220;REvil was among the most notorious cybercrime gangs in the world until July 2021 when they disappeared. REvil is a ransomware-as-a-service (RaaS) operation and generally motivated by financial gain,&#8221; a <a href="https://home.treasury.gov/news/press-releases/jy2041" target="_blank" rel="noopener">statement</a> from the <strong>U.S. Department of the Treasury</strong> reads. &#8220;REvil ransomware has been deployed on approximately 175,000 computers worldwide, with at least $200 million paid in ransom.&#8221;</p>
<p>The sanctions say Ermakov went by multiple aliases on Russian cybercrime forums, including <strong>GustaveDore</strong>, <strong>JimJones</strong>, and Blade Runner. A search on the handle GustaveDore at the cyber intelligence platform <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> shows this user created a ransomware affiliate program in November 2021 called <strong>Sugar</strong> (a.k.a. Encoded01), which focused on <a href="https://www.malwarebytes.com/blog/news/2022/02/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals" target="_blank" rel="noopener">targeting single computers and end-users instead of corporations</a>.</p>
<div id="attachment_66191" style="width: 760px" class="wp-caption aligncenter"><a href="media/f7e477d1.sugarransomwareaffiliate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/sugarransomwareaffiliate.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66191" decoding="async" loading="lazy" class="wp-image-66191" src="media/f7e477d1.sugarransomwareaffiliate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/sugarransomwareaffiliate.png" alt="" width="750" height="558" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/sugarransomwareaffiliate.png 1046w, https://krebsonsecurity.com/wp-content/uploads/2024/01/sugarransomwareaffiliate-768x571.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/sugarransomwareaffiliate-782x582.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66191" class="wp-caption-text">An ad for the ransomware-as-a-service program Sugar posted by GustaveDore warns readers against sharing information with security researchers, law enforcement, or &#8220;friends of Krebs.&#8221;</p></div>
<p>In November 2020, Intel 471 analysts concluded that GustaveDore&#8217;s alias JimJones &#8220;was using and operating several different ransomware strains, including a private undisclosed strain and one developed by the REvil gang.&#8221;</p>
<p>In 2020, GustaveDore advertised on several Russian discussion forums that he was part of a Russian technology firm called <a href="https://web.archive.org/web/20220322141730/https://shtazi.ru/" target="_blank" rel="noopener">Shtazi</a>, which could be hired for computer programming, web development, and &#8220;reputation management.&#8221; Shtazi&#8217;s website remains in operation today.</p>
<div id="attachment_66196" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66196" decoding="async" loading="lazy" class=" wp-image-66196" src="media/d0187576.shtazi-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru.png" alt="" width="750" height="307" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru.png 1806w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-768x315.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-1536x629.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-782x320.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66196" class="wp-caption-text">A Google-translated version of Shtazi dot ru. Image: Archive.org.</p></div>
<p>The third result when one searches for <strong>shtazi[.]ru</strong> in Google is an <strong>Instagram</strong> post from a user named <strong>Mikhail Borisovich Shefel</strong>, who promotes Shtazi&#8217;s services as if it were also his business. If this name sounds familiar, it&#8217;s because in December 2023 KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">identified Mr. Shefel as &#8220;Rescator,&#8221;</a> the cybercriminal identity tied to tens of millions of payment cards that were stolen in 2013 and 2014 from big box retailers <a href="https://krebsonsecurity.com/tag/target-breach/" target="_blank" rel="noopener">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach" target="_blank" rel="noopener">Home Depot</a>, among others.</p>
<p>How close was the connection between GustaveDore and Mr. Shefel? The Treasury Department&#8217;s sanctions page says Ermakov used the email address <strong>ae.ermak@yandex.ru</strong>. A search for this email at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> shows it was used to register just one domain name: <strong>millioner1[.]com</strong>. DomainTools further finds that a phone number tied to Mr. Shefel (79856696666) was used to register two domains: <strong>millioner[.]pw</strong>, and <strong>shtazi[.]net</strong>.<span id="more-66177"></span></p>
<p>The December 2023 story here that outed Mr. Shefel as Rescator noted that Shefel recently changed his last name to &#8220;<strong>Lenin</strong>,&#8221; and had launched a service called Lenin[.]biz that sells physical USSR-era Ruble notes that bear the image of Vladimir Lenin, the founding father of the Soviet Union. The Instagram account for Mr. Shefel includes images of stacked USSR-era Ruble notes, as well as multiple links to Shtazi.</p>
<div id="attachment_66193" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66193" decoding="async" loading="lazy" class=" wp-image-66193" src="media/6e1bfe1a.shefelinstagram.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/shefelinstagram.png" alt="" width="750" height="525" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/shefelinstagram.png 1245w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shefelinstagram-768x537.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shefelinstagram-782x547.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shefelinstagram-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66193" class="wp-caption-text">The Instagram account of Mikhail Borisovich Shefel, aka MikeMike aka Rescator.</p></div>
<p>In a report published this week, Intel 471 said investigators connected Ermakov to REvil because the stolen Medibank data was published on a blog that had one time been controlled by REvil affiliates who carried out attacks and paid an affiliate fee to the gang.</p>
<p>But by the time of the Medibank hack, the REvil group had mostly scattered after a series of high-profile attacks led to the group being disrupted by law enforcement. In November 2021, <strong>Europol</strong> <a href="https://www.europol.europa.eu/media-press/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged" target="_blank" rel="noopener">announced</a> it arrested seven REvil affiliates who collectively made more than $230 million worth of ransom demands since 2019. At the same time, U.S. authorities <a href="https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/" target="_blank" rel="noopener">unsealed two indictments against a pair of accused REvil cybercriminals</a>.</p>
<p>&#8220;The posting of Medibank&#8217;s data on that blog, however, indicated a connection with that group, although the connection wasn&#8217;t clear at the time,&#8221; Intel 471 wrote. &#8220;This makes sense in retrospect, as Ermakov&#8217;s group had also been a REvil affiliate.&#8221;</p>
<p>It is easy to dismiss sanctions like these as ineffective, because as long as Mr. Ermakov remains in Russia he has little to fear of arrest. However, his alleged role as an apparent top member of REvil paints a target on him as someone who likely possesses large sums of cryptocurrency, <a href="media/a5ac6cd4.RB733.mp3" data-original-source="https://media3.risky.biz/RB733.mp3" target="_blank" rel="noopener">said</a> <strong>Patrick Gray</strong>, the Australian co-host and founder of the security news podcast <strong>Risky Business</strong>.</p>
<p>&#8220;I&#8217;ve seen a few people poo-poohing the sanctions&#8230;but the sanctions component is actually less important than the doxing component,&#8221; Gray said. &#8220;Because this guy&#8217;s life just got a lot more complicated. He&#8217;s probably going to have to pay some bribes to stay out of trouble. Every single criminal in Russia now knows he is a vulnerable 33 year old with an absolute ton of bitcoin. So this is not a happy time for him.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66215
title: Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider
uri: Fla-Man-Charged-in-SIM-Swapping-Spree-is-Key-Suspect-in-Hacker-Groups
url:
https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/

content:
<p>On Jan. 9, 2024, U.S. authorities arrested a 19-year-old Florida man charged with wire fraud, aggravated identity theft, and conspiring with others to use SIM-swapping to steal cryptocurrency. Sources close to the investigation tell KrebsOnSecurity the accused was a key member of a criminal hacking group blamed for a string of cyber intrusions at major U.S. technology companies during the summer of 2022.</p>
<div id="attachment_66232" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66232" decoding="async" class="wp-image-66232" src="media/320fe525.0ktopus-attacks-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/0ktopus-attacks-1.png" alt="" width="750" height="441" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/0ktopus-attacks-1.png 1243w, https://krebsonsecurity.com/wp-content/uploads/2024/01/0ktopus-attacks-1-768x452.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/0ktopus-attacks-1-782x460.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66232" class="wp-caption-text">A graphic depicting how 0ktapus leveraged one victim to attack another. Image credit: Amitai Cohen of Wiz.</p></div>
<p>Prosecutors <a href="https://www.justice.gov/usao-mdfl/pr/palm-coast-man-arrested-wire-fraud-and-aggravated-identity-theft-charges" target="_blank" rel="noopener">say</a> <strong>Noah Michael Urban</strong> of Palm Coast, Fla., stole at least $800,000 from at least five victims between August 2022 and March 2023. In each attack, the victims saw their email and financial accounts compromised after suffering an unauthorized SIM-swap, wherein attackers transferred each victim&#8217;s mobile phone number to a new device that they controlled.</p>
<p>The government says Urban went by the aliases &#8220;<strong>Sosa</strong>&#8221; and &#8220;<strong>King Bob</strong>,&#8221; among others. Multiple trusted sources told KrebsOnSecurity that Sosa/King Bob was a core member of a hacking group behind the 2022 breach at <strong>Twilio</strong>, a company that provides services for making and receiving text messages and phone calls. Twilio <a href="https://www.twilio.com/blog/august-2022-social-engineering-attack" target="_blank" rel="noopener">disclosed</a> in Aug. 2022 that an intrusion had exposed a &#8220;limited number&#8221; of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials.</p>
<p>Shortly after that disclosure, the security firm <strong>Group-IB</strong> <a href="https://blog.group-ib.com/0ktapus" target="_blank" rel="noopener">published a report</a> linking the attackers behind the Twilio intrusion to separate breaches at more than 130 organizations, including <strong>LastPass</strong>, <strong>DoorDash</strong>, <strong>Mailchimp</strong>, and <strong>Plex</strong>. Multiple security firms soon assigned the hacking group the nickname &#8220;<strong>Scattered Spider</strong>.&#8221;</p>
<p>Group-IB dubbed the gang by a different name &#8212; <strong>0ktapus</strong> &#8212; which was a nod to how the criminal group phished employees for credentials. The missives asked users to click a link and log in at a phishing page that mimicked their employer’s <strong>Okta</strong> authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication.</p>
<div id="attachment_66236" style="width: 305px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66236" decoding="async" loading="lazy" class="size-full wp-image-66236" src="media/fc94fc99.noahmichaelurban.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/noahmichaelurban.png" alt="" width="295" height="370" /><p id="caption-attachment-66236" class="wp-caption-text">A booking photo of Noah Michael Urban released by the Volusia County Sheriff.</p></div>
<p>0ktapus used newly-registered domains that often included the name of the targeted company, and sent text messages urging employees to click on links to these domains to view information about a pending change in their work schedule. The phishing sites used a Telegram instant message bot to forward any submitted credentials in real-time, allowing the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website.</p>
<p>0ktapus often leveraged information or access gained in one breach to perpetrate another. As documented by Group-IB, the group pivoted from its access to Twilio to attack at least 163 of its customers. Among those was the encrypted messaging app <strong>Signal</strong>, which <a href="https://support.signal.org/hc/en-us/articles/4850133017242-Twilio-Incident-What-Signal-Users-Need-to-Know" target="_blank" rel="noopener">said</a> the breach could have let attackers re-register the phone number on another device for about 1,900 users.</p>
<p>On July 28 and again on Aug. 7, several employees at email delivery firm Mailchimp provided their remote access credentials to this phishing group. According to <a href="https://krebsonsecurity.com/2022/08/how-1-time-passcodes-became-a-corporate-liability/#:~:text=an%20Aug.%2012%20blog%20post" target="_blank" rel="noopener">an Aug. 12 blog post</a>, the attackers used their access to Mailchimp employee accounts to steal data from 214 customers involved in cryptocurrency and finance.</p>
<p>On August 25, 2022, the password manager service LastPass disclosed a breach in which attackers stole some source code and proprietary LastPass technical information, and weeks later LastPass said an investigation revealed no customer data or password vaults were accessed.</p>
<p>However, on November 30, 2022 LastPass disclosed a far more serious breach that the company said leveraged data stolen in the August breach. LastPass said criminal hackers had stolen encrypted copies of some password vaults, as well as other personal information.</p>
<p>In February 2023, LastPass disclosed that the intrusion involved a highly complex, targeted attack against a DevOps engineer who was one of only four LastPass employees with access to the corporate vault. In that incident, the attackers exploited a security vulnerability in a Plex media server that the employee was running on his home network, and succeeded in installing malicious software that stole passwords and other authentication credentials. The vulnerability exploited by the intruders was patched back in 2020, but the employee never updated his Plex software.</p>
<p>As it happens, Plex announced its own data breach one day before LastPass disclosed its initial August intrusion. On August 24, 2022, Plex’s security team urged users to reset their passwords, saying an intruder had accessed customer emails, usernames and encrypted passwords.</p>
<h2>KING BOB&#8217;S GRAILS</h2>
<p>A review of thousands of messages that Sosa and King Bob posted to several public forums and Discord servers over the past two years shows that the person behind these identities was mainly focused on two things: Sim-swapping, and trading in stolen, unreleased rap music recordings from popular artists.</p>
<p>Indeed, those messages show Sosa/King Bob was obsessed with finding new &#8220;<strong>grails</strong>,&#8221; the slang term used in some cybercrime discussion channels to describe recordings from popular artists that have never been officially released. It stands to reason that King Bob was SIM-swapping important people in the music industry to obtain these files, although there is little to support this conclusion from the public chat records available.</p>
<p>&#8220;I got the most music in the com,&#8221; King Bob bragged in a Discord server in November 2022. &#8220;I got thousands of grails.&#8221;</p>
<p>King Bob&#8217;s chats show he was particularly enamored of stealing the unreleased works of his favorite artists &#8212; <strong>Lil Uzi Vert</strong>, <strong>Playboi Carti</strong>, and <strong>Juice Wrld</strong>. When another Discord user asked if he has Eminem grails, King Bob said he was unsure.</p>
<p>&#8220;I have two folders,&#8221; King Bob explained. &#8220;One with Uzi, Carti, Juicewrld. And then I have &#8216;every other artist.&#8217; Every other artist is unorganized as fuck and has thousands of random shit.&#8221;</p>
<p>King Bob&#8217;s posts on Discord show he quickly became a celebrity on <strong>Leaked[.]cx</strong>, one of most active forums for trading, buying and selling unreleased music from popular artists. The more grails that users share with the Leaked[.]cx community, the more their status and access on the forum grows.</p>
<div id="attachment_66235" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66235" decoding="async" loading="lazy" class=" wp-image-66235" src="media/cd1144b2.leakedcx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/leakedcx.png" alt="" width="750" height="330" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/leakedcx.png 1618w, https://krebsonsecurity.com/wp-content/uploads/2024/01/leakedcx-768x338.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/leakedcx-1536x676.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/01/leakedcx-782x344.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66235" class="wp-caption-text">The last cache of Leaked dot cx indexed by the archive.org on Jan. 11, 2024.</p></div>
<p>And King Bob shared a large number of his purloined tunes with this community. Still others he tried to sell. It&#8217;s unclear how many of those sales were ever consummated, but it is not unusual for a prized grail to sell for anywhere from $5,000 to $20,000.</p>
<p>In mid-January 2024, several Leaked[.]cx regulars began complaining that they hadn&#8217;t seen King Bob in a while and were really missing his grails. On or around Jan. 11, the same day the Justice Department unsealed the indictment against Urban, Leaked[.]cx started blocking people who were trying to visit the site from the United States.</p>
<p>Days later, frustrated Leaked[.]cx users speculated about what could be the cause of the blockage.</p>
<p>&#8220;Probs blocked as part of king bob investigation i think?,&#8221; wrote the user &#8220;Plsdontarrest.&#8221; &#8220;Doubt he only hacked US artists/ppl which is why it&#8217;s happening in multiple countries.&#8221;<span id="more-66215"></span></p>
<h2>FORESHADOWING</h2>
<p>On Sept. 21, 2022, KrebsOnSecurity told the story of a &#8220;<strong>Foreshadow</strong>,&#8221; the nickname chosen by a Florida teenager who was working for a SIM-swapping crew when he was <a href="https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/" target="_blank" rel="noopener">abducted, beaten and held for a $200,000 ransom</a>. A rival SIM-swapping group claimed that Foreshadow and his associates had robbed them of their fair share of the profits from a recent SIM-swap.</p>
<p>In a video released by his abductors on Telegram, a bloodied, battered Foreshadow was made to say they would kill him unless the ransom was paid.</p>
<p>As I wrote in that story, Foreshadow appears to have served as a “holder” — a term used to describe a low-level member of any SIM-swapping group who agrees to carry out the riskiest and least rewarding role of the crime: Physically keeping and managing the various mobile devices and SIM cards that are used in SIM-swapping scams.</p>
<p>KrebsOnSecurity has since learned that Foreshadow was a holder for a particularly active SIM-swapper who went by &#8220;Elijah,&#8221; which was another nickname that prosecutors say Urban used.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-65400" src="media/e0d14806.briked.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/briked.png" alt="" width="749" height="485" /></p>
<p>Shortly after Foreshadow&#8217;s hostage video began circulating on Telegram and Discord, multiple known actors in the SIM-swapping space told everyone in the channels to delete any previous messages with Foreshadow, claiming he was fully cooperating with the FBI.</p>
<p>This was not the first time Sosa and his crew were hit with violent attacks from rival SIM-swapping groups. In early 2022, a video surfaced on a popular cybercrime channel purporting to show attackers hurling a brick through a window at an address that matches the spacious and <a href="https://www.zillow.com/homedetails/336-Green-Ash-Ln-Sanford-FL-32771/58181987_zpid/" target="_blank" rel="noopener">upscale home of Urban&#8217;s parents in Sanford, Fl</a>.</p>
<p>&#8220;Brickings&#8221; are among the <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">&#8220;violence-as-a-service&#8221; offerings broadly available on many cybercrime channels</a>. SIM-swapping and adjacent cybercrime channels are replete with job offers for in-person assignments and tasks that can be found if one searches for posts titled, “If you live near,” or “IRL job” — short for “in real life” job.</p>
<p>A number of these classified ads are in service of performing brickings, where someone is hired to visit a specific address and toss a brick through the target’s window. Other typical IRL job offers involve tire slashings and even drive-by shootings.</p>
<h2>THE COM</h2>
<p>Sosa was known to be a top member of the broader cybercriminal community online known as &#8220;<strong>The Com</strong>,&#8221; wherein hackers boast loudly about high-profile exploits and hacks that almost invariably begin with social engineering &#8212; tricking people over the phone, email or SMS into giving away credentials that allow remote access to corporate internal networks.</p>
<p>Sosa also was active in a particularly destructive group of accomplished criminal SIM-swappers known as &#8220;<strong>Star Fraud</strong>.&#8221; Cyberscoop&#8217;s <strong>AJ Vicens</strong> reported last year that individuals within Star Fraud were likely involved in the high-profile <strong>Caesars Entertainment</strong> an <strong>MGM Resorts</strong> extortion attacks.</p>
<p>&#8220;ALPHV, an established ransomware-as-a-service operation thought to be based in Russia and linked to attacks on dozens of entities, claimed responsibility for Caesars and MGM attacks in a note posted to its website earlier this month,&#8221; Vicens <a href="https://cyberscoop.com/youth-hacking-ring-at-the-center-of-cybercrime-spree/" target="_blank" rel="noopener">wrote</a>. &#8220;Experts had said the attacks were the work of a group tracked variously as UNC 3944 or Scattered Spider, which has been described as an affiliate working with ALPHV made up of people in the United States and Britain who excel at social engineering.&#8221;</p>
<p>In February 2023, KrebsOnSecurity published data taken from the Telegram channels for Star Fraud and two other SIM-swapping groups showing these crooks focused on SIM-swapping <strong>T-Mobile</strong> customers, and that they collectively <a href="https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/" target="_blank" rel="noopener">claimed access to T-Mobile on 100 separate occasions over a 7-month period in 2022</a>.</p>
<p>The SIM-swapping groups were able to switch targeted phone numbers to another device on demand because they constantly phished T-Mobile employees into giving up credentials to employee-only tools. In each of those cases the goal was the same: Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert <em>any</em> T-Mobile user’s text messages and phone calls to another device.</p>
<p><strong>Allison Nixon</strong>, chief research officer at the New York cybersecurity consultancy <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a>, said the increasing brazenness of many Com members is a function of how long it has taken federal authorities to go after guys like Sosa.</p>
<p>&#8220;These incidents show what happens when it takes too long for cybercriminals to get arrested,&#8221; Nixon said. &#8220;If governments fail to prioritize this source of threat, violence originating from the Internet will affect regular people.&#8221;</p>
<h2>NO FIXED ADDRESS</h2>
<p><em>The Daytona Beach News-Journal</em> <a href="https://www.news-journalonline.com/story/news/crime/2024/01/25/noah-michael-urban-to-remain-jailed-in-crypto-case-judge-lists-reasons/72356290007/" target="_blank" rel="noopener">reports</a> that Urban was arrested Jan. 9 and his trial is scheduled to begin in the trial term starting March 4 in Jacksonville. The publication said the judge overseeing Urban&#8217;s case denied bail because the defendant was a strong flight risk.</p>
<p>At Urban&#8217;s arraignment, it emerged that he had no fixed address and had been using an alias to stay at an Airbnb. The judge reportedly said that when a search warrant was executed at Urban&#8217;s residence, the defendant was downloading programs to delete computer files.</p>
<p>What&#8217;s more, the judge explained, despite telling authorities in May that he would not have any more contact with his co-conspirators and would not engage in cryptocurrency transactions, he did so anyway.</p>
<p>Urban entered a plea of not guilty. Urban&#8217;s court-appointed attorney said her client would have no comment at this time.</p>
<p>Prosecutors charged Urban with eight counts of wire fraud, one count of conspiracy to commit wire fraud, and five counts of aggravated identity theft. According to the government, if convicted Urban faces up to 20 years in federal prison on each wire fraud charge. He also faces a minimum mandatory penalty of two years in prison for the aggravated identity offenses, which will run consecutive to any other prison sentence imposed.</p>


feed_id: https://krebsonsecurity.com/?p=66268
title: Arrests in $400M SIM-Swap Tied to Heist at FTX?
uri: Arrests-in-400M-SIM-Swap-Tied-to-Heist-at-FTX
url: https://krebsonsecurity.com/2024/02/arrests-in-400m-sim-swap-tied-to-heist-at-ftx/
content:
<p>Three Americans were charged this week with stealing more than $400 million in a November 2022 SIM-swapping attack. The U.S. government did not name the victim organization, but there is every indication that the money was stolen from the now-defunct cryptocurrency exchange <strong>FTX</strong>, which had just filed for bankruptcy on that same day.</p>
<div id="attachment_66273" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66273" decoding="async" class=" wp-image-66273" src="media/0e2ad44f.elliptic-ftx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/elliptic-ftx.png" alt="" width="751" height="385" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/elliptic-ftx.png 991w, https://krebsonsecurity.com/wp-content/uploads/2024/02/elliptic-ftx-768x394.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/elliptic-ftx-782x401.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-66273" class="wp-caption-text">A graphic illustrating the flow of more than $400 million in cryptocurrencies stolen from FTX on Nov. 11-12, 2022. Image: Elliptic.co.</p></div>
<p>An indictment unsealed this week and first reported on by <a href="https://arstechnica.com/tech-policy/2024/01/sim-swapping-ring-stole-400m-in-crypto-from-a-us-company-officials-allege/" target="_blank" rel="noopener">Ars Technica</a> alleges that Chicago man <strong>Robert Powell</strong>, a.k.a. &#8220;R,&#8221; &#8220;R$&#8221; and &#8220;ElSwapo1,&#8221; was the ringleader of a SIM-swapping group called the &#8220;Powell SIM Swapping Crew.&#8221; Colorado resident <strong>Emily &#8220;Em&#8221; Hernandez</strong> allegedly helped the group gain access to victim devices in service of SIM-swapping attacks between March 2021 and April 2023. Indiana resident <strong>Carter Rohn</strong>, a.k.a. &#8220;Carti,&#8221; and &#8220;Punslayer,&#8221; allegedly assisted in compromising devices.</p>
<p>In a SIM-swapping attack, the crooks transfer the target&#8217;s phone number to a device they control, allowing them to intercept any text messages or phone calls sent to the victim, including one-time passcodes for authentication or password reset links sent via SMS.</p>
<p>The indictment states that the perpetrators in this heist stole the $400 million in cryptocurrencies on Nov. 11, 2022 after they SIM-swapped an AT&amp;T customer by impersonating them at a retail store using a fake ID. However, the document refers to the victim in this case only by the name &#8220;Victim 1.&#8221;</p>
<p>Wired&#8217;s <strong>Andy Greenberg</strong> recently <a href="https://www.wired.com/story/ftx-1-billion-crypto-heist/" target="_blank" rel="noopener">wrote</a> about FTX&#8217;s all-night race to stop a $1 billion crypto heist that occurred on the evening of November 11:</p>
<blockquote><p>&#8220;FTX’s staff had already endured one of the worst days in the company’s short life. What had recently been one of the world&#8217;s top cryptocurrency exchanges, valued at $32 billion only 10 months earlier, had just declared bankruptcy. Executives had, after an extended struggle, persuaded the company&#8217;s CEO, Sam Bankman-Fried, to hand over the reins to John Ray III, a new chief executive now tasked with shepherding the company through a nightmarish thicket of debts, many of which it seemed to have no means to pay.&#8221;</p>
<p>&#8220;FTX had, it seemed, hit rock bottom. Until someone—a thief or thieves who have yet to be identified—chose that particular moment to make things far worse. That Friday evening, exhausted FTX staffers began to see mysterious outflows of the company&#8217;s cryptocurrency, publicly captured on the Etherscan website that tracks the Ethereum blockchain, representing hundreds of millions of dollars worth of crypto being stolen in real time.&#8221;</p></blockquote>
<p>The indictment says the $400 million was stolen over several hours between November 11 and 12, 2022. <strong>Tom Robinson</strong>, co-founder of the blockchain intelligence firm <a href="https://www.elliptic.co/blog/three-individuals-implicated-in-the-477-million-ftx-heist" target="_blank" rel="noopener">Elliptic</a>, said the attackers in the FTX heist began to drain FTX wallets on the evening of Nov. 11, 2022 local time, and continuing until the 12th of November.</p>
<p>Robinson said Elliptic is not aware of any other crypto heists of that magnitude occurring on that date.</p>
<p>&#8220;We put the value of the cryptoassets stolen at $477 million,&#8221; Robinson said. &#8220;The FTX administrators have reported overall losses due to “unauthorized third-party transfers” of $413 million &#8211; the discrepancy is likely due to subsequent seizure and return of some of the stolen assets. Either way, it&#8217;s certainly over $400 million, and we are not aware of any other thefts from crypto exchanges on this scale, on this date.&#8221;<span id="more-66268"></span></p>
<p>The SIM-swappers allegedly responsible for the $400 million crypto theft are all U.S. residents. But there are some indications they had help from organized cybercriminals based in Russia. In October 2023, Elliptic released <a href="https://www.elliptic.co/blog/the-477-million-ftx-hack-following-the-blockchain-trail" target="_blank" rel="noopener">a report</a> that found the money stolen from FTX had been laundered through exchanges with ties to criminal groups based in Russia.</p>
<p>&#8220;A Russia-linked actor seems a stronger possibility,&#8221; Elliptic wrote. &#8220;Of the stolen assets that can be traced through ChipMixer, significant amounts are combined with funds from Russia-linked criminal groups, including ransomware gangs and darknet markets, before being sent to exchanges. This points to the involvement of a broker or other intermediary with a nexus in Russia.&#8221;</p>
<p><strong>Nick Bax</strong>, director of analytics at the cryptocurrency wallet recovery firm <a href="https://www.unciphered.com" target="_blank" rel="noopener">Unciphered</a>, said the flow of stolen FTX funds looks more like what his team has seen from groups based in Eastern Europe and Russian than anything they&#8217;ve witnessed from US-based SIM-swappers.</p>
<p>&#8220;I was a bit surprised by this development but it seems to be consistent with reports from CISA [the Cybersecurity and Infrastructure Security Agency] and others that &#8220;Scattered Spider&#8221; has worked with [ransomware] groups like ALPHV/BlackCat,&#8221; Bax said.</p>
<p>CISA&#8217;s <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a" target="_blank" rel="noopener">alert on Scattered Spider</a> says they are a cybercriminal group that targets large companies and their contracted information technology (IT) help desks.</p>
<p>&#8220;Scattered Spider threat actors, per trusted third parties, have typically engaged in data theft for extortion and have also been known to utilize BlackCat/ALPHV ransomware alongside their usual TTPs,&#8221; CISA said, referring to the group&#8217;s signature &#8220;Tactics, Techniques an Procedures.&#8221;</p>
<div id="attachment_66288" style="width: 601px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66288" decoding="async" loading="lazy" class="size-full wp-image-66288" src="media/9ade8b52.bax-ftx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/bax-ftx.png" alt="" width="591" height="541" /><p id="caption-attachment-66288" class="wp-caption-text">Nick Bax, posting on Twitter/X in Nov 2022 about his research on the $400 million FTX heist.</p></div>
<p>Earlier this week, KrebsOnSecurity published a story noting that a Florida man recently charged with being part of a SIM-swapping conspiracy <a href="https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/" target="_blank" rel="noopener">is thought to be a key member of Scattered Spider</a>, a hacking group also known as <strong>0ktapus</strong>. That group has been blamed for a string of cyber intrusions at major U.S. technology companies during the summer of 2022.</p>
<p>Financial claims involving FTX&#8217;s bankruptcy proceedings are being handled by the financial and risk consulting giant <strong>Kroll</strong>. In August 2023, Kroll <a href="https://krebsonsecurity.com/2023/08/kroll-employee-sim-swapped-for-crypto-investor-data/" target="_blank" rel="noopener">suffered its own breach</a> after a Kroll employee was SIM-swapped. According to Kroll, the thieves stole user information for multiple cryptocurrency platforms that rely on Kroll services to handle bankruptcy proceedings.</p>
<p>KrebsOnSecurity sought comment for this story from Kroll, the <strong>FBI</strong>, the prosecuting attorneys, and <strong>Sullivan &amp; Cromwell</strong>, the law firm handling the FTX bankruptcy. This story will be updated in the event any of them respond.</p>
<p>Attorneys for Mr. Powell said they do not know who Victim 1 is in the indictment, as the government hasn&#8217;t shared that information yet. Powell&#8217;s next court date is a detention hearing on Feb. 2, 2024.</p>


feed_id: https://krebsonsecurity.com/?p=66307
title: From Cybercrime Saul Goodman to the Russian GRU
uri: From-Cybercrime-Saul-Goodman-to-the-Russian-GRU
url: https://krebsonsecurity.com/2024/02/from-cybercrime-saul-goodman-to-the-russian-gru/
content:
<p>In 2021, the exclusive Russian cybercrime forum <strong>Mazafaka</strong> was hacked. The leaked user database shows one of the forum&#8217;s founders was an attorney who advised Russia&#8217;s top hackers on the legal risks of their work, and what to do if they got caught. A review of this user&#8217;s hacker identities shows that during his time on the forums he served as an officer in the special forces of the <strong>GRU</strong>, the foreign military intelligence agency of the Russian Federation.</p>
<p>Launched in 2001 under the tagline &#8220;Network terrorism,&#8221; Mazafaka would evolve into one of the most guarded Russian-language cybercrime communities. The forum&#8217;s member roster includes a Who&#8217;s Who of top Russian cybercriminals, and it featured sub-forums for a wide range of cybercrime specialities, including malware, spam, coding and identity theft.</p>
<div id="attachment_66321" style="width: 959px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66321" decoding="async" class="size-full wp-image-66321" src="media/736bbe28.maza-hacked.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/maza-hacked.png" alt="" width="949" height="494" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/maza-hacked.png 949w, https://krebsonsecurity.com/wp-content/uploads/2024/02/maza-hacked-768x400.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/maza-hacked-782x407.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/02/maza-hacked-267x140.png 267w" sizes="(max-width: 949px) 100vw, 949px" /><p id="caption-attachment-66321" class="wp-caption-text">One representation of the leaked Mazafaka database.</p></div>
<p>In almost any database leak, the first accounts listed are usually the administrators and early core members. But <a href="https://krebsonsecurity.com/2021/03/three-top-russian-cybercrime-forums-hacked/" target="_blank" rel="noopener">the Mazafaka user information posted online</a> was not a database file per se, and it was clearly edited, redacted and restructured by whoever released it. As a result, it can be difficult to tell which members are the earliest users.</p>
<p>The original Mazafaka is known to have been launched by a hacker using the nickname &#8220;<strong>Stalker</strong>.&#8221; However, the lowest numbered (non-admin) user ID in the Mazafaka database belongs to another individual who used the handle &#8220;<strong>Djamix</strong>,&#8221; and the email address <strong>djamix@mazafaka[.]ru</strong>.</p>
<p>From the forum&#8217;s inception until around 2008, Djamix was one of its most active and eloquent contributors. Djamix told forum members he was a lawyer, and nearly all of his posts included legal analyses of various public cases involving hackers arrested and charged with cybercrimes in Russia and abroad.</p>
<p>&#8220;Hiding with purely technical parameters will not help in a serious matter,&#8221; Djamix advised Maza members in September 2007. &#8220;In order to ESCAPE the law, you need to KNOW the law. This is the most important thing. Technical capabilities cannot overcome intelligence and cunning.&#8221;</p>
<p>Stalker himself credited Djamix with keeping Mazafaka online for so many years. In <a href="https://infraud.livejournal.com/37235.html" target="_blank" rel="noopener">a retrospective post</a> published to <strong>Livejournal</strong> in 2014 titled, &#8220;Mazafaka, from conception to the present day,&#8221; Stalker said Djamix had become a core member of the community.</p>
<p>&#8220;This guy is everywhere,&#8221; Stalker said of Djamix. &#8220;There&#8217;s not a thing on [Mazafaka] that he doesn&#8217;t take part in. For me, he is a stimulus-irritant and thanks to him, Maza is still alive. Our rallying force!&#8221;</p>
<p>Djamix told other forum denizens he was a licensed attorney who could be hired for remote or in-person consultations, and his posts on Mazafaka and other Russian boards show several hackers facing legal jeopardy likely took him up on this offer.</p>
<p>&#8220;I have the right to represent your interests in court,&#8221; Djamix said on the Russian-language cybercrime forum Verified in Jan. 2011. &#8220;Remotely (in the form of constant support and consultations), or in person &#8211; this is discussed separately. As well as the cost of my services.&#8221;<span id="more-66307"></span></p>
<h2>WHO IS DJAMIX?</h2>
<p>A search on djamix@mazafaka[.]ru at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> reveals this address has been used to register at least 10 domain names since 2008. Those include several websites about life in and around <strong>Sochi</strong>, Russia, the site of the 2014 Winter Olympics, as well as a nearby coastal town called <strong>Adler</strong>. All of those sites say they were registered to an <strong>Aleksei Safronov</strong> from Sochi who also lists Adler as a hometown.</p>
<p>The breach tracking service <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> finds that the phone number associated with those domains &#8212; +7.9676442212 &#8212; is tied to <a href="https://www.facebook.com/profile.php?id=100000407591466" target="_blank" rel="noopener">a Facebook account</a> for an <strong>Aleksei Valerievich Safronov</strong> from Sochi. Mr. Safronov&#8217;s Facebook profile, which was last updated in October 2022, says his ICQ instant messenger number is <strong>53765</strong>. This is the same ICQ number assigned to Djamix in the Mazafaka user database.</p>
<div id="attachment_66316" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66316" decoding="async" loading="lazy" class="wp-image-66316" src="media/73ca0e54.safronov-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/safronov-fb.png" alt="" width="750" height="545" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/safronov-fb.png 991w, https://krebsonsecurity.com/wp-content/uploads/2024/02/safronov-fb-768x558.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/safronov-fb-782x568.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66316" class="wp-caption-text">The Facebook account for Aleksey Safronov.</p></div>
<p>A &#8220;Djamix&#8221; account on the forum privetsochi[.]ru (&#8220;Hello Sochi&#8221;) says this user was born Oct. 2, 1970, and that his website is <strong>uposter[.]ru</strong>. This Russian language news site&#8217;s tagline is, &#8220;We Create Communication,&#8221; and it focuses heavily on news about Sochi, Adler, Russia and the war in Ukraine, with a strong pro-Kremlin bent.</p>
<p>Safronov&#8217;s Facebook profile also gives his Skype username as &#8220;Djamixadler,&#8221; and it includes dozens of photos of him dressed in military fatigues along with a regiment of soldiers deploying in fairly remote areas of Russia. Some of those photos date back to 2008.</p>
<p>In several of the images, we can see a patch on the arm of Safronov&#8217;s jacket that bears the logo of the <a href="https://en.wikipedia.org/wiki/Spetsnaz_GRU" target="_blank" rel="noopener"><strong>Spetsnaz GRU</strong></a>, a special forces unit of the Russian military. According to <a href="https://crsreports.congress.gov/product/pdf/R/R46616/6" target="_blank" rel="noopener">a 2020 report</a> from the <strong>Congressional Research Service</strong>, the GRU operates both as an intelligence agency &#8212; collecting human, cyber, and signals intelligence &#8212; and as a military organization responsible for battlefield reconnaissance and the operation of Russia&#8217;s Spetsnaz military commando units.</p>
<div id="attachment_66315" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66315" decoding="async" loading="lazy" class="wp-image-66315" src="media/79b2b82c.asafronov-bat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/asafronov-bat.png" alt="" width="749" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/asafronov-bat.png 1100w, https://krebsonsecurity.com/wp-content/uploads/2024/02/asafronov-bat-768x464.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/asafronov-bat-782x473.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66315" class="wp-caption-text">Mr. Safronov posted this image of himself on Facebook in 2016. The insignia of the GRU can be seen on his sleeve.</p></div>
<p>&#8220;In recent years, reports have linked the GRU to some of Russia’s most aggressive and public intelligence operations,&#8221; the CRS report explains. &#8220;Reportedly, the GRU played a key role in Russia’s occupation of Ukraine’s Crimea region and invasion of eastern Ukraine, the attempted assassination of former Russian intelligence officer Sergei Skripal in the United Kingdom, interference in the 2016 U.S. presidential elections, disinformation and propaganda operations, and some of the world’s most damaging cyberattacks.&#8221;</p>
<p>According to the Russia-focused investigative news outlet <strong>Meduza</strong>, in 2014 the Russian Defense Ministry created its &#8220;information-operation troops&#8221; for action in &#8220;cyber-confrontations with potential adversaries.&#8221;</p>
<p>&#8220;Later, sources in the Defense Ministry explained that these new troops were meant to &#8216;disrupt the potential adversary’s information networks,'&#8221; Meduza <a href="https://meduza.io/en/feature/2018/11/06/what-is-the-gru-who-gets-recruited-to-be-a-spy-why-are-they-exposed-so-often" target="_blank" rel="noopener">reported in 2018</a>. &#8220;Recruiters reportedly went looking for &#8216;hackers who have had problems with the law.'&#8221;</p>
<p>Mr. Safronov did not respond to multiple requests for comment. A <a href="https://web.archive.org/web/20240207153506/https://dzen.ru/a/W-A-YV05DSo19-7S" target="_blank" rel="noopener">2018 treatise</a> written by Aleksei Valerievich Safronov titled &#8220;One Hundred Years of GRU Military Intelligence&#8221; explains the significance of the bat in the seal of the GRU.</p>
<p>&#8220;One way or another, the bat is an emblem that unites all active and retired intelligence officers; it is a symbol of unity and exclusivity,&#8221; Safronov wrote. &#8220;And, in general, it doesn’t matter who we’re talking about &#8211; a secret GRU agent somewhere in the army or a sniper in any of the special forces brigades. They all did and are doing one very important and responsible thing.&#8221;</p>
<p>It&#8217;s unclear what role Mr. Safronov plays or played in the GRU, but it seems likely the military intelligence agency would have exploited his considerable technical skills, knowledge and connections on the Russian cybercrime forums.</p>
<p>Searching on Safronov&#8217;s domain uposter[.]ru in Constella Intelligence reveals that this domain was used in 2022 to register an account at a popular Spanish-language discussion forum dedicated to helping applicants prepare for a career in the <strong>Guardia Civil</strong>, one of Spain&#8217;s two national police forces. Pivoting on that Russian IP in Constella shows three other accounts were created at the same Spanish user forum around the same date.</p>
<p><strong>Mark Rasch</strong>, a former cybercrime prosecutor for the <strong>U.S. Department of Justice</strong>, said there has always been a close relationship between the GRU and the Russian hacker community. Rasch noted that in the early 2000s, the GRU was soliciting hackers with the skills necessary to hack US banks in order to procure funds to help finance Russia&#8217;s war in Chechnya.</p>
<p>&#8220;The guy is heavily hooked into the Russian cyber community, and that&#8217;s useful for intelligence services,&#8221; Rasch said. &#8220;He could have been infiltrating the community to monitor it for the GRU. Or he could just be a guy wearing a military uniform.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66342
title: Juniper Support Portal Exposed Customer Device Info
uri: Juniper-Support-Portal-Exposed-Customer-Device-Info
url: https://krebsonsecurity.com/2024/02/juniper-support-portal-exposed-customer-device-info/
content:
<p>Until earlier this week, the support website for networking equipment vendor <strong>Juniper Networks</strong> was exposing potentially sensitive information tied to customer products, including which devices customers bought, as well as each product&#8217;s warranty status, service contracts and serial numbers. Juniper said it has since fixed the problem, and that the inadvertent data exposure stemmed from a recent upgrade to its support portal.</p>
<p><img decoding="async" class="aligncenter wp-image-66346" src="media/cf570b75.junipernetworks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/junipernetworks.png" alt="" width="750" height="501" /></p>
<p>Sunnyvale, Calif. based Juniper Networks makes high-powered Internet routers and switches, and its products are used in some of the world&#8217;s largest organizations. Earlier this week KrebsOnSecurity heard from a reader responsible for managing several Juniper devices, who found he could use Juniper&#8217;s customer support portal to find device and support contract information for other Juniper customers.</p>
<p><strong>Logan George</strong> is a <a href="https://www.linkedin.com/in/lgeorge1/" target="_blank" rel="noopener">17-year-old intern</a> working for an organization that uses Juniper products. George said he found the data exposure earlier this week by accident while searching for support information on a particular Juniper product.</p>
<p>George discovered that after logging in with a regular customer account, Juniper&#8217;s support website allowed him to list detailed information about virtually any Juniper device purchased by other customers. Searching on <strong>Amazon.com </strong>in the Juniper portal, for example, returned tens of thousands of records. Each record included the device&#8217;s model and serial number, the approximate location where it is installed, as well as the device&#8217;s status and associated support contract information.</p>
<div id="attachment_66347" style="width: 644px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66347" decoding="async" loading="lazy" class="size-full wp-image-66347" src="media/5ec63c7a.juniperportal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/juniperportal.png" alt="" width="634" height="538" /><p id="caption-attachment-66347" class="wp-caption-text">Information exposed by the Juniper support portal. Columns not pictured include Serial Number, Software Support Reference number, Product, Warranty Expiration Date and Contract ID.</p></div>
<p>George said the exposed support contract information is potentially sensitive because it shows which Juniper products are most likely to be lacking critical security updates.</p>
<p>&#8220;If you don&#8217;t have a support contract you don&#8217;t get updates, it&#8217;s as simple as that,&#8221; George said. &#8220;Using serial numbers, I could see which products aren&#8217;t under support contracts. And then I could narrow down where each device was sent through their serial number tracking system, and potentially see all of what was sent to the same location. A lot of companies don&#8217;t update their switches very often, and knowing what they use allows someone to know what attack vectors are possible.&#8221;</p>
<p>In a written statement, Juniper said the data exposure was the result of a recent upgrade to its support portal.</p>
<p>&#8220;We were made aware of an inadvertent issue that allowed registered users to our system to access serial numbers that were not associated with their account,&#8221; the statement reads. &#8220;We acted promptly to resolve this issue and have no reason to believe at this time that any identifiable or personal customer data was exposed in any way. We take these matters seriously and always use these experiences to prevent further similar incidents. We are actively working to determine the root cause of this defect and thank the researcher for bringing this to our attention.&#8221;<span id="more-66342"></span></p>
<p>The company has not yet responded to requests for information about exactly when those overly permissive user rights were introduced. However, the changes may date back to September 2023, when Juniper <a href="https://supportportal.juniper.net/s/article/Juniper-Support-Tools-Update-October-2021-Announcements?language=en_US" target="_blank" rel="noopener">announced</a> it had rebuilt its customer support portal.</p>
<p>George told KrebsOnSecurity the back-end for Juniper&#8217;s support website appears to be supported by <strong>Salesforce</strong>, and that Juniper likely did not have the proper user permissions established on its Salesforce assets. In April 2023, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/" target="_blank" rel="noopener">published research</a> showing that a shocking number of organizations &#8212; including banks, healthcare providers and state and local governments &#8212; were leaking private and sensitive data thanks to misconfigured Salesforce installations.</p>
<p><strong>Nicholas Weaver</strong>, a researcher at University of California, Berkeley’s International Computer Science Institute (ICSI) and lecturer at UC Davis, said the complexity layered into modern tech support portals leaves much room for error.</p>
<p>&#8220;This is a reminder of how hard it is to build these large systems like support portals, where you need to be able to manage gazillions of users with distinct access roles,&#8221; Weaver said. &#8220;One minor screw up there can produce hilarious results.&#8221;</p>
<p>Last month, computer maker <strong>Hewlett Packard Enterprise</strong> <a href="https://www.reuters.com/markets/deals/hewlett-packard-enterprise-nears-13-bln-deal-buy-juniper-networks-wsj-2024-01-08/" target="_blank" rel="noopener">announced</a> it would buy Juniper Networks for $14 billion, reportedly to help beef up the 100-year-old technology company&#8217;s artificial intelligence offerings.</p>
<p>Update, 11:01 a.m. ET: An earlier version of this story quoted George as saying he was able to see support information for the U.S. Department of Defense. George has since clarified that while one block of device records he found was labeled &#8220;Department of Defense,&#8221; that record appears to belong to a different country.</p>


feed_id: https://krebsonsecurity.com/?p=66376
title: U.S. Internet Leaked Years of Internal, Customer Emails
uri: U-S-Internet-Leaked-Years-of-Internal-Customer-Emails
url: https://krebsonsecurity.com/2024/02/u-s-internet-leaked-years-of-internal-customer-emails/
content:
<p>The Minnesota-based Internet provider <strong>U.S. Internet Corp.</strong> has a business unit called <strong>Securence</strong>, which specializes in providing filtered, secure email services to businesses, educational institutions and government agencies worldwide. But until it was notified last week, U.S. Internet was publishing more than a decade&#8217;s worth of its internal email &#8212; and that of thousands of Securence clients &#8212; in plain text out on the Internet and just a click away for anyone with a Web browser.</p>
<p>Headquartered in Minnetonka, Minn., U.S. Internet is a regional ISP that provides fiber and wireless Internet service. The ISP&#8217;s Securence division bills itself &#8220;a leading provider of email filtering and management software that includes email protection and security services for small business, enterprise, educational and government institutions worldwide.&#8221;</p>
<div id="attachment_66397" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66397" decoding="async" class=" wp-image-66397" src="media/b81a96b4.securence-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/securence-home.png" alt="" width="750" height="529" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/securence-home.png 1294w, https://krebsonsecurity.com/wp-content/uploads/2024/02/securence-home-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/securence-home-782x551.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/02/securence-home-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66397" class="wp-caption-text">U.S. Internet/Securence says your email is secure. Nothing could be further from the truth.</p></div>
<p>Roughly a week ago, KrebsOnSecurity was contacted by <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, a Milwaukee-based cybersecurity firm. Hold Security founder <strong>Alex Holden</strong> said his researchers had unearthed a public link to a U.S. Internet email server listing more than 6,500 domain names, each with its own clickable link.</p>
<div id="attachment_66393" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66393" decoding="async" loading="lazy" class=" wp-image-66393" src="media/8876ed64.USI-customers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/USI-customers.png" alt="" width="750" height="801" /><p id="caption-attachment-66393" class="wp-caption-text">A tiny portion of the more than 6,500 customers who trusted U.S. Internet with their email.</p></div>
<p>Drilling down into those individual domain links revealed inboxes for each employee or user of these exposed websites. Some of the exposed emails dated back to 2008; others were as recent as the present day.</p>
<p>Securence counts among its customers dozens of state and local governments, including: <strong>nc.gov</strong> &#8212; the official website of North Carolina; <strong>stillwatermn.gov</strong>, the website for the city of Stillwater, Minn.; and <strong>cityoffrederickmd.gov</strong>, the website for the government of <strong>Frederick, Md</strong>.</p>
<p>Incredibly, included in this giant index of U.S. Internet customer emails were the internal messages for every current and former employee of U.S. Internet and its subsidiary <strong>USI Wireless</strong>. Since that index also included the messages of U.S. Internet&#8217;s <strong>CEO Travis Carter</strong>, KrebsOnSecurity forwarded one of Mr. Carter&#8217;s own recent emails to him, along with a request to understand how exactly the company managed to screw things up so spectacularly.</p>
<div id="attachment_66394" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66394" decoding="async" loading="lazy" class="size-full wp-image-66394" src="media/f6d7ad63.uswireless-inboxes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/uswireless-inboxes.png" alt="" width="748" height="799" /><p id="caption-attachment-66394" class="wp-caption-text">Individual inboxes of U.S. Wireless employees were published in clear text on the Internet. </p></div>
<p>Within minutes of that notification, U.S. Internet pulled all of the published inboxes offline. Mr. Carter responded and said his team was investigating how it happened. In the same breath, the CEO asked if KrebsOnSecurity does security consulting for hire (I do not).</p>
<p>[Author&#8217;s note: Perhaps Mr. Carter was frantically casting about for any expertise he could find in a tough moment. But I found the request personally offensive, because I couldn&#8217;t shake the notion that maybe the company was hoping it could buy my silence.]<span id="more-66376"></span></p>
<p>Earlier this week, Mr. Carter replied with a highly technical explanation that ultimately did little to explain why or how so many internal and customer inboxes were published in plain text on the Internet.</p>
<p>&#8220;The feedback from my team was a issue with the <a href="https://docs.ansible.com/ansible/latest/playbook_guide/index.html" target="_blank" rel="noopener">Ansible playbook</a> that controls the <a href="https://en.wikipedia.org/wiki/Nginx" target="_blank" rel="noopener">Nginx</a> configuration for our <a href="https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol" target="_blank" rel="noopener">IMAP</a> servers,&#8221; Carter said, noting that this incorrect configuration was put in place by a former employee and never caught. U.S. Internet has not shared how long these messages were exposed.</p>
<p>&#8220;The rest of the platform and other backend services are being audited to verify the Ansible playbooks are correct,&#8221; Carter said.</p>
<p>Holden said he also discovered that hackers have been abusing a Securence link scrubbing and anti-spam service called <strong>Url-Shield</strong> to create links that look benign but instead redirect visitors to hacked and malicious websites.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-66396" src="media/33ab51d8.securence-urlshield.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/securence-urlshield.png" alt="" width="731" height="139" /></p>
<p>&#8220;The bad guys modify the malicious link reporting into redirects to their own malicious sites,&#8221; Holden said. &#8220;That&#8217;s how the bad guys drive traffic to their sites and increase search engine rankings.&#8221;</p>
<p>For example, clicking the Securence link shown in the screenshot directly above leads one to a website that tries to trick visitors into <a href="https://krebsonsecurity.com/2020/11/be-very-sparing-in-allowing-site-notifications/" target="_blank" rel="noopener">allowing site notifications</a> by couching the request as a CAPTCHA request designed to separate humans from bots. After approving the deceptive CAPTCHA/notification request, the link forwards the visitor to a Russian internationalized domain name (рпроаг[.]рф).</p>
<div id="attachment_66395" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66395" decoding="async" loading="lazy" class=" wp-image-66395" src="media/24e7b623.badcaptcha-usinternet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/badcaptcha-usinternet.png" alt="" width="749" height="488" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/badcaptcha-usinternet.png 1126w, https://krebsonsecurity.com/wp-content/uploads/2024/02/badcaptcha-usinternet-768x501.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/badcaptcha-usinternet-782x510.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66395" class="wp-caption-text">The link to this malicious and deceptive website was created using Securence&#8217;s link-scrubbing service. Notification pop-ups were blocked when this site tried to disguise a prompt for accepting notifications as a form of CAPTCHA.</p></div>
<p>U.S. Internet has not responded to questions about how long it has been exposing all of its internal and customer emails, or when the errant configuration changes were made. The company also still has not disclosed the incident on its website. The last press release on the site dates back to March 2020.</p>
<p>KrebsOnSecurity has been writing about data breaches for nearly two decades, but this one easily takes the cake in terms of the level of incompetence needed to make such a huge mistake unnoticed. I&#8217;m not sure what the proper response from authorities or regulators should be to this incident, but it&#8217;s clear that U.S. Internet should not be allowed to manage anyone&#8217;s email unless and until it can demonstrate more transparency, and prove that it has radically revamped its security.</p>


feed_id: https://krebsonsecurity.com/?p=66378
title: Fat Patch Tuesday, February 2024 Edition
uri: Fat-Patch-Tuesday-February-2024-Edition
url: https://krebsonsecurity.com/2024/02/fat-patch-tuesday-february-2024-edition/
content:
<p><strong>Microsoft Corp.</strong> today pushed software updates to plug more than 70 security holes in its <strong>Windows</strong> operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks.</p>
<p><img decoding="async" loading="lazy" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="750" height="528" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Top of the heap on this Fat Patch Tuesday is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412" target="_blank" rel="noopener">CVE-2024-21412</a>, a &#8220;security feature bypass&#8221; in the way Windows handles Internet Shortcut Files that Microsoft says is being targeted in active exploits. Redmond&#8217;s advisory for this bug says an attacker would need to convince or trick a user into opening a malicious shortcut file.</p>
<p>Researchers at <a href="https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html" target="_blank" rel="noopener">Trend Micro</a> have tied the ongoing exploitation of CVE-2024-21412 to an advanced persistent threat group dubbed &#8220;<strong>Water Hydra</strong>,&#8221; which they say has being using the vulnerability to execute a malicious Microsoft Installer File (.msi) that in turn unloads a remote access trojan (RAT) onto infected Windows systems.</p>
<p>The other zero-day flaw is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21351" target="_blank" rel="noopener">CVE-2024-21351</a>, another security feature bypass &#8212; this one in the built-in <strong>Windows SmartScreen</strong> component that tries to screen out potentially malicious files downloaded from the Web. <strong>Kevin Breen</strong> at <strong>Immersive Labs</strong> says it&#8217;s important to note that this vulnerability alone is not enough for an attacker to compromise a user&#8217;s workstation, and instead would likely be used in conjunction with something like a spear phishing attack that delivers a malicious file.</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, said this is the fifth vulnerability in Windows SmartScreen patched since 2022 and all five have been exploited in the wild as zero-days. They include CVE-2022-44698 in December 2022, CVE-2023-24880 in March 2023, CVE-2023-32049 in July 2023 and CVE-2023-36025 in November 2023.</p>
<p>Narang called special attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21410" target="_blank" rel="noopener">CVE-2024-21410</a>, an &#8220;elevation of privilege&#8221; bug in <strong>Microsoft Exchange Server</strong> that Microsoft says is likely to be exploited by attackers. Attacks on this flaw would lead to the disclosure of NTLM hashes, which could be leveraged as part of an NTLM relay or &#8220;pass the hash&#8221; attack, which lets an attacker masquerade as a legitimate user without ever having to log in.</p>
<p>&#8220;We know that flaws that can disclose sensitive information like NTLM hashes are very valuable to attackers,&#8221; Narang said. &#8220;A Russian-based threat actor leveraged a similar vulnerability to carry out attacks – CVE-2023-23397 is an Elevation of Privilege vulnerability in Microsoft Outlook patched in March 2023.&#8221;<span id="more-66378"></span></p>
<p>Microsoft notes that prior to its Exchange Server 2019 Cumulative Update 14 (CU14), a security feature called Extended Protection for Authentication (EPA), which provides NTLM credential relay protections, was not enabled by default.</p>
<p>&#8220;Going forward, CU14 enables this by default on Exchange servers, which is why it is important to upgrade,&#8221; Narang said.</p>
<p>Rapid7&#8217;s lead software engineer <strong>Adam Barnett</strong> highlighted <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21413" target="_blank" rel="noopener">CVE-2024-21413</a>, a critical remote code execution bug in <strong>Microsoft Office</strong> that could be exploited just by viewing a specially-crafted message in the Outlook Preview pane.</p>
<p>&#8220;Microsoft Office typically shields users from a variety of attacks by opening files with Mark of the Web in Protected View, which means Office will render the document without fetching potentially malicious external resources,&#8221; Barnett said. &#8220;CVE-2024-21413 is a critical RCE vulnerability in Office which allows an attacker to cause a file to open in editing mode as though the user had agreed to trust the file.&#8221;</p>
<p>Barnett stressed that administrators responsible for Office 2016 installations who apply patches outside of Microsoft Update should note the advisory lists no fewer than five separate patches which must be installed to achieve remediation of CVE-2024-21413; individual update knowledge base (KB) articles further note that partially-patched Office installations will be blocked from starting until the correct combination of patches has been installed.</p>
<p>It&#8217;s a good idea for Windows end-users to stay current with security updates from Microsoft, which can quickly pile up otherwise. That doesn&#8217;t mean you have to install them on Patch Tuesday. Indeed, waiting a day or three before updating is a sane response, given that sometimes updates go awry and usually within a few days Microsoft has fixed any issues with its patches. It&#8217;s also smart to back up your data and/or image your Windows drive before applying new updates.</p>
<p>For a more detailed breakdown of the individual flaws addressed by Microsoft today, check out the <a href="https://isc.sans.edu/diary/Microsoft%20February%202024%20Patch%20Tuesday/30646" target="_blank" rel="noopener">SANS Internet Storm Center&#8217;s list</a>. For those admins responsible for maintaining larger Windows environments, it often pays to keep an eye on <a href="https://www.askwoody.com" target="_blank" rel="noopener">Askwoody.com</a>, which frequently points out when specific Microsoft updates are creating problems for a number of users.</p>


feed_id: https://krebsonsecurity.com/?p=66432
title: Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates
uri: Feds-Seize-LockBit-Ransomware-Websites-Offer-Decryption-Tools-Troll
url:
https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/

content:
<p>U.S. and U.K. authorities have seized the darknet websites run by <strong>LockBit</strong>, a prolific and destructive ransomware group that has claimed more than 2,000 victims worldwide and extorted over $120 million in payments. Instead of listing data stolen from ransomware victims who didn&#8217;t pay, LockBit&#8217;s victim shaming website now offers free recovery tools, as well as news about arrests and criminal charges involving LockBit affiliates.</p>
<div id="attachment_66436" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66436" decoding="async" class=" wp-image-66436" src="media/aadce34b.lockbitseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png" alt="" width="749" height="474" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png 1379w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-768x486.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-782x494.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66436" class="wp-caption-text">Investigators used the existing design on LockBit&#8217;s victim shaming website to feature press releases and free decryption tools.</p></div>
<p>Dubbed &#8220;<a href="https://www.justice.gov/opa/pr/us-and-uk-disrupt-lockbit-ransomware-variant" target="_blank" rel="noopener">Operation Cronos</a>,&#8221; the law enforcement action involved the seizure of nearly three-dozen servers; the arrest of two alleged LockBit members; the unsealing of two indictments; the release of a free LockBit decryption tool; and the freezing of more than 200 cryptocurrency accounts thought to be tied to the gang&#8217;s activities.</p>
<p>LockBit members have executed attacks against thousands of victims in the United States and around the world, according to the <strong>U.S. Department of Justice </strong>(DOJ). First surfacing in September 2019, the gang is estimated to have made hundreds of millions of U.S. dollars in ransom demands, and extorted over $120 million in ransom payments.</p>
<p>LockBit operated as a ransomware-as-a-service group, wherein the ransomware gang takes care of everything from the bulletproof hosting and domains to the development and maintenance of the malware. Meanwhile, affiliates are solely responsible for finding new victims, and can reap 60 to 80 percent of any ransom amount ultimately paid to the group.</p>
<p>A statement on Operation Cronos from the European police agency <a href="https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation" target="_blank" rel="noopener">Europol</a> said the months-long infiltration resulted in the compromise of LockBit’s primary platform and other critical infrastructure, including the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States and the United Kingdom. Europol said two suspected LockBit actors were arrested in Poland and Ukraine, but no further information has been released about those detained.</p>
<p>The DOJ today unsealed indictments against two Russian men alleged to be active members of LockBit. The government says Russian national <strong>Artur Sungatov</strong> used LockBit ransomware against victims in manufacturing, logistics, insurance and other companies throughout the United States.</p>
<p><strong>Ivan Gennadievich Kondratyev</strong>, a.k.a. &#8220;Bassterlord,&#8221; allegedly deployed LockBit against targets in the United States, Singapore, Taiwan, and Lebanon. Kondratyev is also <a href="media/2323b5ec.vasiliev.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/vasiliev.pdf" target="_blank" rel="noopener">charged</a> (PDF) with three criminal counts arising from his alleged use of the Sodinokibi (aka &#8220;<a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">REvil</a>&#8220;) ransomware variant to encrypt data, exfiltrate victim information, and extort a ransom payment from a corporate victim based in Alameda County, California.</p>
<p>With the indictments of Sungatov and Kondratyev, a total of five LockBit affiliates now have been officially charged. In May 2023, U.S. authorities unsealed indictments against two alleged LockBit affiliates, <strong>Mikhail &#8220;Wazawaka&#8221; Matveev</strong> and <strong>Mikhail Vasiliev</strong>.</p>
<p>Vasiliev, 35, of Bradford, Ontario, Canada, is in custody in Canada awaiting extradition to the United States (the complaint against Vasiliev is at <a href="media/2323b5ec.vasiliev.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/vasiliev.pdf" target="_blank" rel="noopener">this PDF</a>). Matveev remains at large, presumably still in Russia. In January 2022, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">Who is the Network Access Broker ‘Wazawaka,’</a> which followed clues from Wazawaka’s many pseudonyms and contact details on the Russian-language cybercrime forums back to a 31-year-old Mikhail Matveev from Abaza, RU.</p>
<div id="attachment_63686" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63686" decoding="async" loading="lazy" class=" wp-image-63686" src="media/5c483978.fbiwanted-matveev.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png" alt="" width="749" height="735" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png 804w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev-768x754.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev-782x767.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-63686" class="wp-caption-text">An FBI wanted poster for Matveev.</p></div>
<p>In June 2023, Russian national <strong>Ruslan Magomedovich Astamirov</strong> was charged in New Jersey for his participation in the LockBit conspiracy, including the deployment of LockBit against victims in Florida, Japan, France, and Kenya. Astamirov is currently in custody in the United States awaiting trial.</p>
<p>LockBit was known to have recruited affiliates that worked with multiple ransomware groups simultaneously, and it&#8217;s unclear what impact this takedown may have on competing ransomware affiliate operations. The security firm <strong>ProDaft</strong> <a href="https://x.com/prodaft/status/1759906800311157066?s=46&amp;t=FA8la2ipfsQG7kSh21skxQ" target="_blank" rel="noopener">said</a> on Twitter/X that the infiltration of LockBit by investigators provided &#8220;in-depth visibility into each affiliate’s structures, including ties with other notorious groups such as FIN7, Wizard Spider, and EvilCorp.&#8221;</p>
<p>In a lengthy thread about the LockBit takedown on the Russian-language cybercrime forum XSS, one of the gang&#8217;s leaders said the <strong>FBI</strong> and the U.K.&#8217;s <strong>National Crime Agency</strong> (NCA) had infiltrated its servers using <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-3824" target="_blank" rel="noopener">a known vulnerability in PHP</a>, a scripting language that is widely used in Web development.<span id="more-66432"></span></p>
<p>Several denizens of XSS wondered aloud why the PHP flaw was not flagged by LockBit&#8217;s vaunted &#8220;Bug Bounty&#8221; program, which promised a financial reward to affiliates who could find and quietly report any security vulnerabilities threatening to undermine LockBit&#8217;s online infrastructure.</p>
<p>This prompted several XSS members to start posting memes taunting the group about the security failure.</p>
<p>&#8220;Does it mean that the FBI provided a pentesting service to the affiliate program?,&#8221; one denizen quipped. &#8220;Or did they decide to take part in the bug bounty program? :):)&#8221;</p>
<p>Federal investigators also appear to be trolling LockBit members with their seizure notices. LockBit&#8217;s data leak site previously featured a countdown timer for each victim organization listed, indicating the time remaining for the victim to pay a ransom demand before their stolen files would be published online. Now, the top entry on the shaming site is a countdown timer until the public doxing of &#8220;LockBitSupp,&#8221; the unofficial spokesperson or figurehead for the LockBit gang.</p>
<p>&#8220;Who is LockbitSupp?&#8221; the teaser reads. &#8220;The $10m question.&#8221;</p>
<p>In January 2024, LockBitSupp told XSS forum members he was disappointed the FBI hadn&#8217;t offered a reward for his doxing and/or arrest, and that in response he was placing a bounty on his own head &#8212; offering $10 million to anyone who could discover his real name.</p>
<p>&#8220;My god, who needs me?,&#8221; LockBitSupp wrote on Jan. 22, 2024. &#8220;There is not even a reward out for me on the FBI website. By the way, I want to use this chance to increase the reward amount for a person who can tell me my full name from USD 1 million to USD 10 million. The person who will find out my name, tell it to me and explain how they were able to find it out will get USD 10 million. Please take note that when looking for criminals, the FBI uses unclear wording offering a reward of UP TO USD 10 million; this means that the FBI can pay you USD 100, because technically, it&#8217;s an amount UP TO 10 million. On the other hand, I am willing to pay USD 10 million, no more and no less.&#8221;</p>
<p><strong>Mark Stockley</strong>, cybersecurity evangelist at the security firm Malwarebytes, said the NCA is obviously trolling the LockBit group and LockBitSupp.</p>
<p>&#8220;I don&#8217;t think this is an accident—this is how ransomware groups talk to each other,&#8221; Stockley said. &#8220;This is law enforcement taking the time to enjoy its moment, and humiliate LockBit in its own vernacular, presumably so it loses face.&#8221;</p>
<p>In a press conference today, the FBI said Operation Cronos included investigative assistance from the Gendarmerie-C3N in France; the State Criminal Police Office L-K-A and Federal Criminal Police Office in Germany; Fedpol and Zurich Cantonal Police in Switzerland; the National Police Agency in Japan; the Australian Federal Police; the Swedish Police Authority; the National Bureau of Investigation in Finland; the Royal Canadian Mounted Police; and the National Police in the Netherlands.</p>
<p>The Justice Department said victims targeted by LockBit should contact the FBI at <a class="ext" href="https://lockbitvictims.ic3.gov/" target="_blank" rel="noopener" data-extlink="">https://lockbitvictims.ic3.gov/</a> to determine whether affected systems can be successfully decrypted. In addition, the Japanese Police, supported by Europol, have <a href="https://www.nomoreransom.org/en/decryption-tools.html" target="_blank" rel="noopener">released a recovery tool</a> designed to recover files encrypted by the LockBit 3.0 Black Ransomware.</p>


feed_id: https://krebsonsecurity.com/?p=66455
title: New Leak Shows Business Side of China’s APT Menace
uri: New-Leak-Shows-Business-Side-of-China-s-APT-Menace
url: https://krebsonsecurity.com/2024/02/new-leak-shows-business-side-of-chinas-apt-menace/
content:
<p>A new data leak that appears to have come from one of China&#8217;s top private cybersecurity firms provides a rare glimpse into the commercial side of China&#8217;s many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage campaigns to the nation&#8217;s burgeoning and highly competitive cybersecurity industry.</p>
<div id="attachment_66472" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66472" decoding="async" class=" wp-image-66472" src="media/76aaf7f1.i-soon-apt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/i-soon-apt.png" alt="" width="749" height="481" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/i-soon-apt.png 1170w, https://krebsonsecurity.com/wp-content/uploads/2024/02/i-soon-apt-768x493.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/i-soon-apt-782x502.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66472" class="wp-caption-text">A marketing slide deck promoting i-SOON&#8217;s Advanced Persistent Threat (APT) capabilities.</p></div>
<p>A large cache of more than 500 documents <a href="https://github.com/I-S00N/I-S00N" target="_blank" rel="noopener">published to GitHub</a> last week indicate the records come from <strong>i-SOON</strong>, a technology company headquartered in Shanghai that is perhaps best known for providing cybersecurity training courses throughout China. But the leaked documents, which include candid employee chat conversations and images, show a less public side of i-SOON, one that frequently initiates and sustains cyberespionage campaigns commissioned by various Chinese government agencies.</p>
<p>The leaked documents suggest i-SOON employees were responsible for a raft of cyber intrusions over many years, infiltrating government systems in the United Kingdom and countries throughout Asia. Although the cache does not include raw data stolen from cyber espionage targets, it features numerous documents listing the level of access gained and the types of data exposed in each intrusion.</p>
<p>Security experts who reviewed the leaked data say they believe the information is legitimate, and that i-SOON works closely with China&#8217;s Ministry of Public Security and the military. In 2021, the Sichuan provincial government named i-SOON as one of &#8220;the top 30 information security companies.&#8221;</p>
<p>&#8220;The leak provides some of the most concrete details seen publicly to date, revealing the maturing nature of China’s cyber espionage ecosystem,&#8221; <a href="https://www.sentinelone.com/labs/unmasking-i-soon-the-leak-that-revealed-chinas-cyber-operations/" target="_blank" rel="noopener">said</a> <strong>Dakota Cary</strong>, a China-focused consultant at the security firm <strong>SentinelOne</strong>. &#8220;It shows explicitly how government targeting requirements drive a competitive marketplace of independent contractor hackers-for-hire.&#8221;</p>
<p><a href="https://www.linkedin.com/in/meidanowski/" target="_blank" rel="noopener">Mei Danowski</a> is a former intelligence analyst and China expert who now writes about her research in a Substack publication called Natto Thoughts. Danowski said i-SOON has achieved the highest secrecy classification that a non-state-owned company can receive, which qualifies the company to conduct classified research and development related to state security.</p>
<p>i-SOON’s &#8220;business services&#8221; webpage states that the company&#8217;s offerings include public security, anti-fraud, blockchain forensics, enterprise security solutions, and training. Danowski said that in 2013, i-SOON established a department for research on developing new APT network penetration methods.</p>
<p>APT stands for Advanced Persistent Threat, a term that generally refers to state-sponsored hacking groups. Indeed, among the documents apparently leaked from i-SOON is a sales pitch slide boldly highlighting the hacking prowess of the company&#8217;s &#8220;APT research team&#8221; (see screenshot above).</p>
<div id="attachment_66480" style="width: 291px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66480" decoding="async" loading="lazy" class="size-full wp-image-66480" src="media/d465eb3d.shutdown-haibo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/shutdown-haibo.png" alt="" width="281" height="378" /><p id="caption-attachment-66480" class="wp-caption-text">i-SOON CEO Wu Haibo, in 2011. Image: nattothoughts.substack.com.</p></div>
<p>The leaked documents included a lengthy chat conversation between the company&#8217;s founders, who repeatedly discuss flagging sales and the need to secure more employees and government contracts. Danowski said the CEO of i-SOON, <strong>Wu Haibo</strong> (&#8220;Shutdown&#8221; in the leaked chats) is a well-known first-generation red hacker or &#8220;Honker,&#8221; and an early member of Green Army &#8212; the very first Chinese hacktivist group founded in 1997. Mr. Haibo has not yet responded to a request for comment.</p>
<p>In October 2023, Danowski <a href="https://nattothoughts.substack.com/p/i-soon-another-company-in-the-apt41" target="_blank" rel="noopener">detailed</a> how i-SOON became embroiled in a software development contract dispute when it was sued by a competing Chinese cybersecurity company called <strong>Chengdu 404</strong>. In September 2021, the <strong>U.S. Department of Justice</strong> <a href="https://krebsonsecurity.com/2020/09/chinese-antivirus-firm-was-part-of-apt41-supply-chain-attack/" target="_blank" rel="noopener">unsealed indictments against multiple Chengdu 404 employees</a>, charging that the company was a facade that hid more than a decade&#8217;s worth of cyber intrusions attributed to a threat actor group known as &#8220;APT 41.&#8221;</p>
<p>Danowski said the existence of this legal dispute suggests that Chengdu 404 and i-SOON have or at one time had a business relationship, and that one company likely served as a subcontractor to the other.</p>
<p>&#8220;From what they chat about we can see this is a very competitive industry, where companies in this space are constantly poaching each others&#8217; employees and tools,&#8221; Danowski said. &#8220;The infosec industry is always trying to distinguish [the work] of one APT group from another. But that&#8217;s getting harder to do.&#8221;</p>
<p>It remains unclear if i-SOON&#8217;s work has earned it a unique APT designation. But <strong>Will Thomas</strong>, a cyber threat intelligence researcher at Equinix, found an Internet address in the leaked data that corresponds to a domain flagged in <a href="https://twitter.com/BushidoToken/status/1759388221476139376" target="_blank" rel="noopener">a 2019 Citizen Lab report</a> about one-click mobile phone exploits that were being used to target groups in Tibet. The 2019 report referred to the threat actor behind those attacks as an APT group called <strong>Poison Carp.</strong><span id="more-66455"></span></p>
<p>Several images and chat records in the data leak suggest i-SOON&#8217;s clients periodically gave the company a list of targets they wanted to infiltrate, but sometimes employees confused the instructions. <a href="https://twitter.com/DakotaInDC/status/1759398404508049885/photo/1" target="_blank" rel="noopener">One screenshot</a> shows a conversation in which an employee tells his boss they&#8217;ve just hacked one of the universities on their latest list, only to be told that the victim in question was not actually listed as a desired target.</p>
<p>The leaked chats show i-SOON continuously tried to recruit new talent by hosting a series of hacking competitions across China. It also performed charity work, and sought to engage employees and sustain morale with various team-building events.</p>
<p>However, the chats include multiple conversations between employees commiserating over long hours and low pay. The overall tone of the discussions indicates employee morale was quite low and that the workplace environment was fairly toxic. In several of the conversations, i-SOON employees openly discuss with their bosses how much money they just lost gambling online with their mobile phones while at work.</p>
<p>Danowski believes the i-SOON data was probably leaked by one of those disgruntled employees.</p>
<p>&#8220;This was released the first working day after the Chinese New Year,&#8221; Danowski said. &#8220;Definitely whoever did this planned it, because you can&#8217;t get all this information all at once.&#8221;</p>
<p>SentinelOne&#8217;s Cary said he came to the same conclusion, noting that the Protonmail account tied to the GitHub profile that published the records was registered a month before the leak, on January 15, 2024.</p>
<p>China&#8217;s much vaunted <a href="https://krebsonsecurity.com/2015/08/chinese-vpn-service-as-attack-platform/" target="_blank" rel="noopener">Great Firewall</a> not only lets the government control and limit what citizens can access online, but this distributed spying apparatus allows authorities to block data on Chinese citizens and companies from ever leaving the country.</p>
<p>As a result, China enjoys a remarkable information asymmetry vis-a-vis virtually all other industrialized nations. Which is why this apparent data leak from i-SOON is such a rare find for Western security researchers.</p>
<p>&#8220;I was so excited to see this,&#8221; Cary said. &#8220;Every day I hope for data leaks coming out of China.&#8221;</p>
<p>That information asymmetry is at the heart of the Chinese government&#8217;s cyberwarfare goals, according to <a href="media/5798ed3d.China-s-Cyber-Operations-Full-Report.pdf" data-original-source="https://margin.re/content/files/2023/01/China-s-Cyber-Operations-Full-Report.pdf" target="_blank" rel="noopener">a 2023 analysis</a> by <strong>Margin Research</strong> performed on behalf of the <strong>Defense Advanced Research Projects Agency</strong> (DARPA).</p>
<p>&#8220;In the area of cyberwarfare, the western governments see cyberspace as a &#8216;fifth domain&#8217; of warfare,&#8221; the Margin study observed. &#8220;The Chinese, however, look at cyberspace in the broader context of information space. The ultimate objective is, not &#8216;control&#8217; of cyberspace, but control of information, a vision that dominates China’s cyber operations.&#8221;</p>
<p>The National Cybersecurity Strategy <a href="https://krebsonsecurity.com/2023/03/highlights-from-the-new-u-s-cybersecurity-strategy/" target="_blank" rel="noopener">issued by the White House last year</a> singles out China as the biggest cyber threat to U.S. interests. While the United States government does contract certain aspects of its cyber operations to companies in the private sector, it does not follow China&#8217;s example in promoting the wholesale theft of state and corporate secrets for the commercial benefit of its own private industries.</p>
<p><strong>Dave Aitel</strong>, a co-author of the Margin Research report and former computer scientist at the <strong>U.S. National Security Agency</strong>, said it&#8217;s nice to see that Chinese cybersecurity firms have to deal with all of the same contracting headaches facing U.S. companies seeking work with the federal government.</p>
<p>&#8220;This leak just shows there&#8217;s layers of contractors all the way down,&#8221; Aitel said. &#8220;It&#8217;s pretty fun to see the Chinese version of it.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66495
title: FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga.
uri: FBI-s-LockBit-Takedown-Postponed-a-Ticking-Time-Bomb-in-Fulton-Count
url:
https://krebsonsecurity.com/2024/02/fbis-lockbit-takedown-postponed-a-ticking-time-bomb-in-fulton-county-ga/

content:
<p>The FBI&#8217;s takedown of the <strong>LockBit</strong> ransomware group last week came as LockBit was preparing to release sensitive data stolen from government computer systems in <strong>Fulton County, Ga</strong>. But LockBit is now regrouping, and the gang says it will publish the stolen Fulton County data on March 2 unless paid a ransom. LockBit claims the cache includes documents tied to the county&#8217;s ongoing criminal prosecution of former <strong>President Trump</strong>, but court watchers say teaser documents published by the crime gang suggest a total leak of the Fulton County data could put lives at risk and jeopardize a number of other criminal trials.</p>
<div id="attachment_66501" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66501" decoding="async" class=" wp-image-66501" src="media/a4ead976.fultonga-lockbit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit.png" alt="" width="749" height="454" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit.png 1140w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit-768x466.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit-782x474.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66501" class="wp-caption-text">A new LockBit website listing a countdown timer until the promised release of data stolen from Fulton County, Ga.</p></div>
<p>In early February, Fulton County leaders acknowledged they were responding to an intrusion that caused disruptions for its phone, email and billing systems, as well as a range of county services, including court systems.</p>
<p>On Feb. 13, the LockBit ransomware group posted on its victim shaming blog a new entry for Fulton County, featuring a countdown timer saying the group would publish the data on Feb. 16 unless county leaders agreed to negotiate a ransom.</p>
<p>&#8220;We will demonstrate how local structures negligently handled information protection,&#8221; LockBit warned. &#8220;We will reveal lists of individuals responsible for confidentiality. Documents marked as confidential will be made publicly available. We will show documents related to access to the state citizens&#8217; personal data. We aim to give maximum publicity to this situation; the documents will be of interest to many. Conscientious residents will bring order.&#8221;</p>
<p>Yet on Feb. 16, the entry for Fulton County was removed from LockBit&#8217;s site without explanation. This usually only happens after the victim in question agrees to pay a ransom demand and/or enters into negotiations with their extortionists.</p>
<p>However, Fulton County Commission Chairman <strong>Robb Pitts</strong> said the board decided it &#8220;could not in good conscience use Fulton County taxpayer funds to make a payment.&#8221;</p>
<p>&#8220;We did not pay nor did anyone pay on our behalf,&#8221; Pitts said at an incident briefing on Feb. 20.</p>
<p>Just hours before that press conference, LockBit&#8217;s various websites were seized by the FBI and the U.K.&#8217;s National Crime Agency (NCA), which replaced the ransomware group&#8217;s homepage with a seizure notice and used the existing design of LockBit&#8217;s victim shaming blog to publish press releases about the law enforcement action.</p>
<div id="attachment_66436" style="width: 759px" class="wp-caption aligncenter"><a href="media/aadce34b.lockbitseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66436" decoding="async" loading="lazy" class="wp-image-66436" src="media/aadce34b.lockbitseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png" alt="" width="749" height="474" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png 1379w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-768x486.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-782x494.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-66436" class="wp-caption-text">The feds used the existing design on LockBit&#8217;s victim shaming website to feature press releases and free decryption tools.</p></div>
<p>Dubbed &#8220;<a href="https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/" target="_blank" rel="noopener">Operation Cronos</a>,&#8221; the effort involved the seizure of nearly three-dozen servers; the arrest of two alleged LockBit members; the release of a free LockBit decryption tool; and the freezing of more than 200 cryptocurrency accounts thought to be tied to the gang’s activities. The government says LockBit has claimed more than 2,000 victims worldwide and extorted over $120 million in payments.</p>
<h2>UNFOLDING DISASTER</h2>
<p>In a lengthy, <a href="https://www.databreaches.net/as-expected-lockbit-is-back-already/" target="_blank" rel="noopener">rambling letter</a> published on Feb. 24 and addressed to the FBI, the ransomware group&#8217;s leader <strong>LockBitSupp</strong> announced that their victim shaming websites were once again operational on the dark web, with fresh countdown timers for Fulton County and a half-dozen other recent victims.</p>
<p>&#8220;The FBI decided to hack now for one reason only, because they didn’t want to leak information fultoncountyga.gov,&#8221; LockBitSupp wrote. &#8220;The stolen documents contain a lot of interesting things and Donald Trump’s court cases that could affect the upcoming US election.&#8221;</p>
<div id="attachment_66517" style="width: 317px" class="wp-caption alignright"><a href="media/020ee02c.fultonss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonss.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66517" decoding="async" loading="lazy" class="wp-image-66517" src="media/020ee02c.fultonss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonss.png" alt="" width="307" height="375" /></a><p id="caption-attachment-66517" class="wp-caption-text">A screen shot released by LockBit showing various Fulton County file shares that were exposed.</p></div>
<p>LockBit has already released roughly two dozen files allegedly stolen from Fulton County government systems, although none of them involve Mr. Trump&#8217;s criminal trial. But the documents do appear to include court records that are sealed and shielded from public viewing.</p>
<p><strong>George Chidi</strong> writes <em>The Atlanta Objective</em>, a Substack publication on crime in Georgia&#8217;s capital city. Chidi says the leaked data so far includes a sealed record related to a child abuse case, and a sealed motion in the <a href="https://www.ajc.com/news/crime/2-arrested-on-murder-gang-charges-weeks-after-shooting-at-se-atlanta-apartments/K4IBL5KP65EZNGVETIK2NLZO6E/" target="_blank" rel="noopener">murder trial of Juwuan Gaston</a> demanding the state turn over confidential informant identities.</p>
<p>Chidi cites reports from a Fulton County employee who said the confidential material includes the identities of jurors serving on the <a href="https://www.nytimes.com/article/young-thug-ysl-rico-trial.html" target="_blank" rel="noopener">trial of the rapper Jeffery &#8220;Young Thug&#8221; Williams</a>, who is charged along with five other defendants in a racketeering and gang conspiracy.</p>
<p>&#8220;The screenshots suggest that hackers will be able to give any attorney defending a criminal case in the county a starting place to argue that evidence has been tainted or witnesses intimidated, and that the release of confidential information has compromised cases,&#8221; Chidi <a href="https://theatlantaobjective.substack.com/p/the-fulton-county-hack-is-a-ticking" target="_blank" rel="noopener">wrote</a>. &#8220;Judge Ural Glanville has, I am told by staff, been working feverishly behind the scenes over the last two weeks to manage the unfolding disaster.&#8221;</p>
<p>LockBitSupp also denied assertions made by the U.K.&#8217;s NCA that LockBit <a href="https://therecord.media/lockbit-lied-about-deleting-exfiltrated-data-after-ransom-payments" target="_blank" rel="noopener">did not delete stolen data as promised when victims agreed to pay a ransom</a>. The accusation is an explosive one because nobody will pay a ransom if they don&#8217;t believe the ransomware group will hold up its end of the bargain.</p>
<p>The ransomware group leader also confirmed information first reported here last week, that federal investigators managed to hack LockBit by exploiting <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-3824" target="_blank" rel="noopener">a known vulnerability in PHP</a>, a scripting language that is widely used in Web development.</p>
<p>&#8220;Due to my personal negligence and irresponsibility I relaxed and did not update PHP in time,&#8221; LockBitSupp wrote. &#8220;As a result of which access was gained to the two main servers where this version of PHP was installed.&#8221;</p>
<p>LockBitSupp&#8217;s FBI letter said the group kept copies of its stolen victim data on servers that did not use PHP, and that consequently it was able to retain copies of files stolen from victims. The letter also listed links to multiple new instances of LockBit dark net websites, including the leak page listing Fulton County&#8217;s new countdown timer.</p>
<div id="attachment_66506" style="width: 503px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66506" decoding="async" loading="lazy" class=" wp-image-66506" src="media/1c0f8dd8.fulton-lb-close.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-lb-close.png" alt="" width="493" height="352" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-lb-close.png 377w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-lb-close-100x70.png 100w" sizes="(max-width: 493px) 100vw, 493px" /><p id="caption-attachment-66506" class="wp-caption-text">LockBit&#8217;s new data leak site promises to release stolen Fulton County data on March 2, 2024, unless paid a ransom demand.</p></div>
<p>&#8220;Even after the FBI hack, the stolen data will be published on the blog, there is no chance of destroying the stolen data without payment,&#8221; LockBitSupp wrote. &#8220;All FBI actions are aimed at destroying the reputation of my affiliate program, my demoralization, they want me to leave and quit my job, they want to scare me because they can not find and eliminate me, I can not be stopped, you can not even hope, as long as I am alive I will continue to do pentest with postpaid.&#8221;<span id="more-66495"></span></p>
<h2>DOX DODGING</h2>
<p>In January 2024, LockBitSupp told XSS forum members he was disappointed the FBI hadn’t offered a reward for his doxing and/or arrest, and that in response he was placing a bounty on his own head — offering $10 million to anyone who could discover his real name.</p>
<p>After the NCA and FBI seized LockBit&#8217;s site, the group&#8217;s homepage was retrofitted with a blog entry titled, &#8220;Who is LockBitSupp? The $10M question.&#8221; The teaser made use of LockBit&#8217;s own countdown timer, and suggested the real identity of LockBitSupp would soon be revealed.</p>
<p>However, after the countdown timer expired the page was replaced with a taunting message from the feds, but it included no new information about LockBitSupp&#8217;s identity.</p>
<p><a href="media/bd82ce07.lockbitsuppreveal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitsuppreveal.png" target="_blank" rel="noopener"><img decoding="async" loading="lazy" class="aligncenter wp-image-66502" src="media/bd82ce07.lockbitsuppreveal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitsuppreveal.png" alt="" width="750" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitsuppreveal.png 1243w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitsuppreveal-768x464.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitsuppreveal-782x472.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a></p>
<p>On Feb. 21, the U.S. Department of State <a href="https://www.securityweek.com/us-offering-10m-for-lockbit-leaders-as-law-enforcement-taunts-cybercriminals/#:~:text=The%20Department%20of%20State%20announced,million%20for%20information%20on%20affiliates." target="_blank" rel="noopener">announced rewards</a> totaling up to $15 million for information leading to the arrest and/or conviction of anyone participating in LockBit ransomware attacks. The State Department said $10 million of that is for information on LockBit&#8217;s leaders, and up to $5 million is offered for information on affiliates.</p>
<p>In <a href="https://twitter.com/vxunderground/status/1760445030387376320" target="_blank" rel="noopener">an interview</a> with the malware-focused Twitter/X account <strong>Vx-Underground</strong>, LockBit staff asserted that authorities had arrested a couple of small-time players in their operation, and that investigators still do not know the real-life identities of the core LockBit members, or that of their leader.</p>
<p>&#8220;They assert the FBI / NCA UK / EUROPOL do not know their information,&#8221; Vx-Underground wrote. &#8220;They state they are willing to double the bounty of $10,000,000. They state they will place a $20,000,000 bounty of their own head if anyone can dox them.&#8221;</p>
<h2>TROUBLE ON THE HOMEFRONT?</h2>
<p>In the weeks leading up to the FBI/NCA takedown, LockBitSupp became embroiled in a number of high-profile personal and business disputes on the Russian cybercrime forums.</p>
<p>Earlier this year, someone used LockBit ransomware to infect the networks of <strong>AN-Security</strong>, a venerated 30-year-old security and technology company based in St. Petersburg, Russia. This violated the golden rule for cybercriminals based in Russia and former soviet nations that make up the Commonwealth of Independent States, which is that attacking your own citizens in those countries is the surest way to get arrested and prosecuted by local authorities.</p>
<p>LockBitSupp later claimed the attacker had used a publicly leaked, older version of LockBit to compromise systems at AN-Security, and said the attack was an attempt to smear their reputation by a rival ransomware group known as &#8220;Clop.&#8221; But the incident no doubt prompted closer inspection of LockBitSupp&#8217;s activities by Russian authorities.</p>
<p>Then in early February, the administrator of the Russian-language cybercrime forum XSS said LockBitSupp had threatened to have him killed after the ransomware group leader was banned by the community. LockBitSupp was excommunicated from XSS after he refused to pay an arbitration amount ordered by the forum administrator. That dispute related to a complaint from another forum member who said LockBitSupp recently stiffed him on his promised share of an unusually large ransomware payout.</p>
<div id="attachment_66504" style="width: 759px" class="wp-caption aligncenter"><a href="media/9742f125.xss-lockbitsupp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/xss-lockbitsupp.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66504" decoding="async" loading="lazy" class="wp-image-66504" src="media/9742f125.xss-lockbitsupp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/xss-lockbitsupp.png" alt="" width="749" height="237" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/xss-lockbitsupp.png 1555w, https://krebsonsecurity.com/wp-content/uploads/2024/02/xss-lockbitsupp-768x243.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/xss-lockbitsupp-1536x486.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/02/xss-lockbitsupp-782x247.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-66504" class="wp-caption-text">A posted by the XSS administrator saying LockBitSupp wanted him dead.</p></div>
<h2>INTERVIEW WITH LOCKBITSUPP</h2>
<p>KrebsOnSecurity sought comment from LockBitSupp at the ToX instant messenger ID listed in his letter to the FBI. LockBitSupp declined to elaborate on the unreleased documents from Fulton County, saying the files will be available for everyone to see in a few days.</p>
<p>LockBitSupp said his team was still negotiating with Fulton County when the FBI seized their servers, which is why the county has been granted a time extension. He also denied threatening to kill the XSS administrator.</p>
<p>&#8220;I have not threatened to kill the XSS administrator, he is blatantly lying, this is to cause self-pity and damage my reputation,&#8221; LockBitSupp told KrebsOnSecurity. &#8220;It is not necessary to kill him to punish him, there are more humane methods and he knows what they are.&#8221;</p>
<p>Asked why he was so certain the FBI doesn&#8217;t know his real-life identity, LockBitSupp was more precise.</p>
<p>&#8220;I&#8217;m not sure the FBI doesn&#8217;t know who I am,&#8221; he said. &#8220;I just believe they will never find me.&#8221;</p>
<p>It seems unlikely that the FBI&#8217;s seizure of LockBit&#8217;s infrastructure was somehow an effort to stave off the disclosure of Fulton County&#8217;s data, as LockBitSupp maintains. For one thing, Europol said the takedown was the result of a months-long infiltration of the ransomware group.</p>
<p>Also, in reporting on the attack&#8217;s disruption to the office of <strong>Fulton County District Attorney Fanny Willis</strong> on Feb. 14, <a href="https://www.cnn.com/2024/02/14/tech/fulton-county-ransomware-attack-financially-motivated-actors/index.html" target="_blank" rel="noopener">CNN reported</a> that by then the intrusion by LockBit had persisted for nearly two and a half weeks.</p>
<p>Finally, if the NCA and FBI really believed that LockBit never deleted victim data, they had to assume LockBit would still have at least one copy of all their stolen data hidden somewhere safe.</p>
<p>Fulton County is still trying to recover systems and restore services affected by the ransomware attack. &#8220;Fulton County continues to make substantial progress in restoring its systems following the recent ransomware incident resulting in service outages,&#8221; reads <a href="https://fultoncountyga.gov/news/2024/02/22/fulton-county-cyber-incident-response-update-february-22" target="_blank" rel="noopener">the latest statement</a> from the county on Feb. 22. &#8220;Since the start of this incident, our team has been working tirelessly to bring services back up.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66552
title: Calendar Meeting Links Used to Spread Mac Malware
uri: Calendar-Meeting-Links-Used-to-Spread-Mac-Malware
url: https://krebsonsecurity.com/2024/02/calendar-meeting-links-used-to-spread-mac-malware/
content:
<p>Malicious hackers are targeting people in the cryptocurrency space in attacks that start with a link added to the target&#8217;s calendar at <strong>Calendly</strong>, a popular application for scheduling appointments and meetings. The attackers impersonate established cryptocurrency investors and ask to schedule a video conference call. But clicking the meeting link provided by the scammers prompts the user to run a script that quietly installs malware on <strong>macOS</strong> systems.</p>
<p>KrebsOnSecurity recently heard from a reader who works at a startup that is seeking investment for building a new blockchain platform for the Web. The reader spoke on condition that their name not be used in this story, so for the sake of simplicity we&#8217;ll call him <strong>Doug</strong>.</p>
<p>Being in the cryptocurrency scene, Doug is also active on the instant messenger platform <strong>Telegram</strong>. Earlier this month, Doug was approached by someone on Telegram whose profile name, image and description said they were <strong>Ian Lee</strong>, from <strong>Signum Capital</strong>, a well-established investment firm based in Singapore. The profile also linked to <a href="https://twitter.com/IanSignum" target="_blank" rel="noopener">Mr. Lee&#8217;s Twitter/X account</a>, which features the same profile image.</p>
<p>The investor expressed interest in financially supporting Doug&#8217;s startup, and asked if Doug could find time for a video call to discuss investment prospects. Sure, Doug said, here&#8217;s my Calendly profile, book a time and we&#8217;ll do it then.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-66560" src="media/827d8452.doug-scammer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/doug-scammer.png" alt="" width="366" height="778" /></p>
<p>When the day and time of the scheduled meeting with Mr. Lee arrived, Doug clicked the meeting link in his calendar but nothing happened. Doug then messaged the Mr. Lee account on Telegram, who said there was some kind of technology issue with the video platform, and that their IT people suggested using a different meeting link.</p>
<p>Doug clicked the new link, but instead of opening up a videoconference app, a message appeared on his Mac saying the video service was experiencing technical difficulties.</p>
<p>&#8220;Some of our users are facing issues with our service,&#8221; the message read. &#8220;We are actively working on fixing these problems. Please refer to this script as a temporary solution.&#8221;</p>
<p>Doug said he ran the script, but nothing appeared to happen after that, and the videoconference application still wouldn&#8217;t start. Mr. Lee apologized for the inconvenience and said they would have to reschedule their meeting, but he never responded to any of Doug&#8217;s follow-up messages.</p>
<p>It didn&#8217;t dawn on Doug until days later that the missed meeting with Mr. Lee might have been a malware attack. Going back to his Telegram client to revisit the conversation, Doug discovered his potential investor had deleted the meeting link and other bits of conversation from their shared chat history.</p>
<p>In <a href="https://twitter.com/Signum_Capital/status/1749345857026379985" target="_blank" rel="noopener">a post</a> to its Twitter/X account last month, <strong>Signum Capital</strong> warned that a fake profile pretending to be their employee Mr. Lee was trying to scam people on Telegram.</p>
<p><img decoding="async" loading="lazy" class="aligncenter  wp-image-66557" src="media/4bb52072.signumdisclaimer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/signumdisclaimer.png" alt="" width="657" height="641" /></p>
<p>The file that Doug ran is a simple Apple Script (file extension &#8220;.scpt&#8221;) that downloads and executes a malicious trojan made to run on macOS systems. Unfortunately for us, Doug freaked out after deciding he&#8217;d been tricked &#8212; backing up his important documents, changing his passwords, and then reinstalling macOS on his computer. While this a perfectly sane response, it means we don&#8217;t have the actual malware that was pushed to his Mac by the script.</p>
<p>But Doug does still have a copy of the malicious script that was downloaded from clicking the meeting link (the online host serving that link is now offline). A search in Google for a string of text from that script turns up a December 2023 blog post from cryptocurrency security firm <strong>SlowMist</strong> about phishing attacks on Telegram from North Korean state-sponsored hackers.</p>
<p>&#8220;When the project team clicks the link, they encounter a region access restriction,&#8221; SlowMist <a href="https://slowmist.medium.com/analysis-of-north-korean-hackers-targeted-phishing-scams-on-telegram-872db3f7392b" target="_blank" rel="noopener">wrote</a>. &#8220;At this point, the North Korean hackers coax the team into downloading and running a &#8216;location-modifying&#8217; malicious script. Once the project team complies, their computer comes under the control of the hackers, leading to the theft of funds.&#8221;</p>
<div id="attachment_66555" style="width: 668px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66555" decoding="async" loading="lazy" class="size-full wp-image-66555" src="media/3a390118.bluenoroff-lure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/bluenoroff-lure.png" alt="" width="658" height="817" /><p id="caption-attachment-66555" class="wp-caption-text">Image: SlowMist.</p></div>
<p>SlowMist says the North Korean phishing scams used the &#8220;Add Custom Link&#8221; feature of the Calendly meeting scheduling system on event pages to insert malicious links and initiate phishing attacks.</p>
<p>&#8220;Since Calendly integrates well with the daily work routines of most project teams, these malicious links do not easily raise suspicion,&#8221; the blog post explains. &#8220;Consequently, the project teams may inadvertently click on these malicious links, download, and execute malicious code.&#8221;<span id="more-66552"></span></p>
<p>SlowMist said the malware downloaded by the malicious link in their case comes from a North Korean hacking group dubbed &#8220;<strong>BlueNoroff</strong>, which <strong>Kaspersky Labs</strong> says is a subgroup of the <strong>Lazarus</strong> hacking group.</p>
<p>&#8220;A financially motivated threat actor closely connected with Lazarus that targets banks, casinos, fin-tech companies, POST software and cryptocurrency businesses, and ATMs,&#8221; Kaspersky <a href="https://securelist.com/bluenoroff-new-macos-malware/111290/" target="_blank" rel="noopener">wrote</a> of BlueNoroff in Dec. 2023.</p>
<p>The North Korean regime is known to use stolen cryptocurrencies to fund its military and other state projects. A recent <a href="https://www.recordedfuture.com/crypto-country-north-koreas-targeting-cryptocurrency" target="_blank" rel="noopener">report</a> from <strong>Recorded Future</strong> finds the Lazarus Group <em>has stolen approximately $3 billion in cryptocurrency over the past six years</em>.</p>
<p>While there is still far more malware out there today targeting <strong>Microsoft Windows</strong> PCs, the prevalence of information-stealing trojans aimed at macOS users is growing at a steady clip. MacOS computers include <strong>X-Protect</strong>, Apple&#8217;s built-in antivirus technology. But experts say attackers are constantly changing the appearance and behavior of their malware to evade X-Protect.</p>
<p>&#8220;Recent updates to macOS’s XProtect signature database indicate that Apple are aware of the problem, but early 2024 has already seen a number of stealer families evade known signatures,&#8221; security firm <strong>SentinelOne</strong> wrote in January.</p>
<p>According to the threat hunting platform <a href="https://hunt.io" target="_blank" rel="noopener">Hunt.io,</a> the Internet address of the fake meeting website Doug was tricked into visiting (104.168.163,149) hosts or very recently hosted about 75 different domain names, many of which invoke words associated with videoconferencing or cryptocurrency. Those domains indicate this North Korean hacking group is hiding behind a number of phony crypto firms, like the six-month-old website for <strong>Cryptowave Capital</strong> (cryptowave[.]capital).</p>
<p><img decoding="async" loading="lazy" class="aligncenter  wp-image-66559" src="media/737dde8a.cryptowave.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/cryptowave.png" alt="" width="749" height="369" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/cryptowave.png 1320w, https://krebsonsecurity.com/wp-content/uploads/2024/02/cryptowave-768x378.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/cryptowave-782x385.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The increasing frequency of new Mac malware is a good reminder that Mac users should not depend on security software and tools to flag malicious files, which are frequently bundled with or disguised as legitimate software.</p>
<p>As KrebsOnSecurity <a href="https://krebsonsecurity.com/2011/05/krebss-3-basic-rules-for-online-safety/" target="_blank" rel="noopener">has advised Windows users for years</a>, a good rule of safety to live by is this: <em>If you didn&#8217;t go looking for it, don&#8217;t install it. </em>Following this mantra heads off a great deal of malware attacks, regardless of the platform used. When you do decide to install a piece of software, make sure you are downloading it from the original source, and then keep it updated with any new security fixes.</p>
<p>On that last front, I&#8217;ve found it&#8217;s a good idea not to wait until the last minute to configure my system before joining a scheduled videoconference call. Even if the call uses software that is already on my computer, it is often the case that software updates are required before the program can be used, and I&#8217;m one of those weird people who likes to review any changes to the software maker&#8217;s privacy policies or user agreements <em>before</em> choosing to install updates.</p>
<p>Most of all, verify new contacts from strangers before accepting anything from them. In this case, had Doug simply messaged Mr. Lee&#8217;s real account on Twitter/X or contacted Signum Capital directly, he would discovered that the real Mr. Lee never asked for a meeting.</p>
<p>If you&#8217;re approached in a similar scheme, the response from the would-be victim documented in the SlowMist blog post is probably the best.</p>
<div id="attachment_66558" style="width: 664px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66558" decoding="async" loading="lazy" class=" wp-image-66558" src="media/0b6343a6.fyouscammers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fyouscammers.png" alt="" width="654" height="604" /><p id="caption-attachment-66558" class="wp-caption-text">Image: SlowMist.</p></div>


feed_id: https://krebsonsecurity.com/?p=66580
title: Fulton County, Security Experts Call LockBit’s Bluff
uri: Fulton-County-Security-Experts-Call-LockBit-s-Bluff
url: https://krebsonsecurity.com/2024/02/fulton-county-security-experts-call-lockbits-bluff/
content:
<p>The ransomware group <strong>LockBit</strong> told officials with <strong>Fulton County, Ga.</strong> they could expect to see their internal documents published online this morning unless the county paid a ransom demand. LockBit removed Fulton County&#8217;s listing from its victim shaming website this morning, claiming the county had paid. But county officials said they did not pay, nor did anyone make payment on their behalf. Security experts say LockBit was likely bluffing and probably lost most of the data when the gang&#8217;s servers were seized this month by U.S. and U.K. law enforcement.</p>
<div id="attachment_66501" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66501" decoding="async" class=" wp-image-66501" src="media/a4ead976.fultonga-lockbit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit.png" alt="" width="751" height="455" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit.png 1140w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit-768x466.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fultonga-lockbit-782x474.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-66501" class="wp-caption-text">The LockBit website included a countdown timer until the promised release of data stolen from Fulton County, Ga. LockBit would later move this deadline up to Feb. 29, 2024.</p></div>
<p>LockBit listed Fulton County as a victim on Feb. 13, saying that unless it was paid a ransom the group would publish files stolen in a breach at the county last month. That attack disrupted county phones, Internet access and even their court system. LockBit leaked a small number of the county&#8217;s files as a teaser, which appeared to include sensitive and sealed court records in current and past criminal trials.</p>
<p>On Feb. 16, Fulton County&#8217;s entry &#8212; along with a countdown timer until the data would be published &#8212; was removed from the LockBit website without explanation. The leader of LockBit told KrebsOnSecurity this was because Fulton County officials had engaged in last-minute negotiations with the group.</p>
<p>But on Feb. 19, investigators with the FBI and the U.K.&#8217;s National Crime Agency (NCA) <a href="https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/" target="_blank" rel="noopener">took over LockBit&#8217;s online infrastructure</a>, replacing the group&#8217;s homepage with a seizure notice and links to LockBit ransomware decryption tools.</p>
<p>In a press briefing on Feb. 20, <strong>Fulton County Commission Chairman Robb Pitts</strong> told reporters the county did not pay a ransom demand, noting that the board &#8220;could not in good conscience use Fulton County taxpayer funds to make a payment.&#8221;</p>
<p>Three days later, LockBit <a href="https://krebsonsecurity.com/2024/02/fbis-lockbit-takedown-postponed-a-ticking-time-bomb-in-fulton-county-ga/" target="_blank" rel="noopener">reemerged with new domains on the dark web</a>, and with Fulton County listed among a half-dozen other victims whose data was about to be leaked if they refused to pay. As it does with all victims, LockBit assigned Fulton County a countdown timer, saying officials had until late in the evening on March 1 until their data was published.</p>
<div id="attachment_66587" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66587" decoding="async" loading="lazy" class=" wp-image-66587" src="media/b93ab994.fulton-feb29.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-feb29.png" alt="" width="749" height="415" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-feb29.png 1106w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-feb29-768x426.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/fulton-feb29-782x433.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66587" class="wp-caption-text">LockBit revised its deadline for Fulton County to Feb. 29.</p></div>
<p>LockBit soon moved up the deadline to the morning of Feb. 29. As Fulton County&#8217;s LockBit timer was counting down to zero this morning, its listing disappeared from LockBit&#8217;s site. LockBit&#8217;s leader and spokesperson, who goes by the handle &#8220;<strong>LockBitSupp</strong>,&#8221; told KrebsOnSecurity today that Fulton County&#8217;s data disappeared from their site because county officials paid a ransom.</p>
<p>&#8220;Fulton paid,&#8221; LockBitSupp said. When asked for evidence of payment, LockBitSupp claimed. &#8220;The proof is that we deleted their data and did not publish it.&#8221;</p>
<p>But at a press conference today, Fulton County Chairman Robb Pitts said the county does not know why its data was removed from LockBit&#8217;s site.</p>
<p>&#8220;As I stand here at 4:08 p.m., we are not aware of any data being released today so far,&#8221; Pitts said. &#8220;That does not mean the threat is over. They could release whatever data they have at any time. We have no control over that. We have not paid any ransom. Nor has any ransom been paid on our behalf.&#8221;<span id="more-66580"></span></p>
<p><strong>Brett Callow</strong>, a threat analyst with the security firm <strong>Emsisoft</strong>, said LockBit likely lost all of the victim data it stole before the FBI/NCA seizure, and that it has been trying madly since then to save face within the cybercrime community.</p>
<p>&#8220;I think it was a case of them trying to convince their affiliates that they were still in good shape,&#8221; Callow said of LockBit&#8217;s recent activities. &#8220;I strongly suspect this will be the end of the LockBit brand.&#8221;</p>
<p>Others have come to a similar conclusion. The security firm <strong>RedSense</strong> posted an analysis to Twitter/X that after the takedown, LockBit published several &#8220;new&#8221; victim profiles for companies that it had listed weeks earlier on its victim shaming site. Those victim firms &#8212; a healthcare provider and major securities lending platform &#8212; also were unceremoniously removed from LockBit&#8217;s new shaming website, despite LockBit claiming their data would be leaked.</p>
<p>&#8220;We are 99% sure the rest of their &#8216;new victims&#8217; are also fake claims (old data for new breaches),&#8221; RedSense <a href="https://twitter.com/RedSenseIntel/status/1763262670243852552" target="_blank" rel="noopener">posted</a>. &#8220;So the best thing for them to do would be to delete all other entries from their blog and stop defrauding honest people.&#8221;</p>
<p>Callow said there certainly have been plenty of cases in the past where ransomware gangs exaggerated their plunder from a victim organization. But this time feels different, he said.</p>
<p>&#8220;It is a bit unusual,&#8221; Callow said. &#8220;This is about trying to still affiliates&#8217; nerves, and saying, &#8216;All is well, we weren&#8217;t as badly compromised as law enforcement suggested.&#8217; But I think you&#8217;d have to be a fool to work with an organization that has been so thoroughly hacked as LockBit has.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66606
title: BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare
uri: BlackCat-Ransomware-Group-Implodes-After-Apparent-22M-Payment-by-Chan
url:
https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/

content:
<p>There are indications that U.S. healthcare giant <strong>Change Healthcare</strong> has made a $22 million extortion payment to the infamous <strong>BlackCat</strong> ransomware group (a.k.a. &#8220;<strong>ALPHV</strong>&#8220;) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However, the cybercriminal who claims to have given BlackCat access to Change&#8217;s network says the crime gang cheated them out of their share of the ransom, and that they still have the sensitive data Change reportedly paid the group to destroy. Meanwhile, the affiliate&#8217;s disclosure appears to have prompted BlackCat to cease operations entirely.</p>
<div id="attachment_58289" style="width: 740px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58289" decoding="async" class="size-full wp-image-58289" src="media/98b9091f.blackcat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/blackcat.png" alt="" width="730" height="346" /><p id="caption-attachment-58289" class="wp-caption-text">Image: Varonis.</p></div>
<p>In the third week of February, a cyber intrusion at Change Healthcare began shutting down important healthcare services as company systems were taken offline. It soon emerged that BlackCat was behind the attack, which has <a href="https://www.nytimes.com/2024/03/05/health/cyberattack-healthcare-cash.html" target="_blank" rel="noopener">disrupted the delivery of prescription drugs</a> for hospitals and pharmacies nationwide for nearly two weeks.</p>
<p>On March 1, a cryptocurrency address that security researchers had already mapped to BlackCat received a single transaction worth approximately $22 million. On March 3, a BlackCat affiliate posted a complaint to the exclusive Russian-language ransomware forum <strong>Ramp</strong> saying that Change Healthcare had paid a $22 million ransom for a decryption key, and to prevent four terabytes of stolen data from being published online.</p>
<p>The affiliate claimed BlackCat/ALPHV took the $22 million payment but never paid him his percentage of the ransom. BlackCat is known as a &#8220;ransomware-as-service&#8221; collective, meaning they rely on freelancers or affiliates to infect new networks with their ransomware. And those affiliates in turn earn commissions ranging from 60 to 90 percent of any ransom amount paid.</p>
<p>&#8220;But after receiving the payment ALPHV team decide to suspend our account and keep lying and delaying when we contacted ALPHV admin,&#8221; the affiliate &#8220;Notchy&#8221; wrote. &#8220;Sadly for Change Healthcare, their data [is] still with us.&#8221;</p>
<p>Change Healthcare has neither confirmed nor denied paying, and has responded to multiple media outlets with a similar non-denial statement &#8212; that the company is <a href="https://www.unitedhealthgroup.com/changehealthcarecyberresponse" target="_blank" rel="noopener">focused on its investigation and on restoring services</a>.</p>
<p>Assuming Change Healthcare did pay to keep their data from being published, that strategy seems to have gone awry: Notchy said the list of affected Change Healthcare partners they&#8217;d stolen sensitive data from included <strong>Medicare</strong> and a host of other major insurance and pharmacy networks.</p>
<p>On the bright side, Notchy&#8217;s complaint seems to have been the final nail in the coffin for the BlackCat ransomware group, which was <a href="https://krebsonsecurity.com/2023/12/blackcat-ransomware-raises-ante-after-fbi-disruption/" target="_blank" rel="noopener">infiltrated by the FBI and foreign law enforcement partners in late December 2023</a>. As part of that action, the government seized the BlackCat website and released a decryption tool to help victims recover their systems.</p>
<p>BlackCat responded by re-forming, and increasing affiliate commissions to as much as 90 percent. The ransomware group also declared it was formally removing any restrictions or discouragement against targeting hospitals and healthcare providers.</p>
<p>However, instead of responding that they would compensate and placate Notchy, a representative for BlackCat said today the group was shutting down and that it had already found a buyer for its ransomware source code.</p>
<div id="attachment_66615" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66615" decoding="async" loading="lazy" class=" wp-image-66615" src="media/4d27a146.alphvseizureexit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/alphvseizureexit.png" alt="" width="751" height="384" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/alphvseizureexit.png 1596w, https://krebsonsecurity.com/wp-content/uploads/2024/03/alphvseizureexit-768x393.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/alphvseizureexit-1536x786.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/alphvseizureexit-782x400.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-66615" class="wp-caption-text">The seizure notice now displayed on the BlackCat darknet website.</p></div>
<p>&#8220;There&#8217;s no sense in making excuses,&#8221; wrote the RAMP member &#8220;Ransom.&#8221; &#8220;Yes, we knew about the problem, and we were trying to solve it. We told the affiliate to wait. We could send you our private chat logs where we are shocked by everything that&#8217;s happening and are trying to solve the issue with the transactions by using a higher fee, but there&#8217;s no sense in doing that because we decided to fully close the project. We can officially state that we got screwed by the feds.&#8221;<span id="more-66606"></span></p>
<p>BlackCat&#8217;s website now features a seizure notice from the FBI, but several researchers noted that this image seems to have been merely cut and pasted from the notice the FBI left in its December raid of BlackCat&#8217;s network. The FBI has not responded to requests for comment.</p>
<p><strong>Fabian Wosar</strong>, head of ransomware research at the security firm <strong>Emsisoft</strong>, said it appears BlackCat leaders are trying to pull an &#8220;exit scam&#8221; on affiliates by withholding many ransomware payment commissions at once and shutting down the service.</p>
<p>&#8220;ALPHV/BlackCat did not get seized,&#8221; Wosar wrote on Twitter/X today. &#8220;They are exit scamming their affiliates. It is blatantly obvious when you check the source code of their new takedown notice.&#8221;</p>
<p><strong>Dmitry Smilyanets</strong>, a researcher for the security firm Recorded Future, said BlackCat&#8217;s exit scam was especially dangerous because the affiliate still has all the stolen data, and could still demand additional payment or leak the information on his own.</p>
<p>&#8220;The affiliates still have this data, and they’re mad they didn’t receive this money, Smilyanets <a href="https://apple.news/A15zH2UVNQpaKt1gwZ8QRCQ" target="_blank" rel="noopener">told Wired.com</a>. &#8220;It’s a good lesson for everyone. You cannot trust criminals; their word is worth nothing.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-66616" src="media/997412da.dstweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/dstweet.png" alt="" width="583" height="569" /></p>
<p>BlackCat&#8217;s apparent demise comes closely on the heels of the implosion of another major ransomware group &#8212; <strong>LockBit</strong>, a ransomware gang estimated to have extorted over $120 million in payments from more than 2,000 victims worldwide. On Feb. 20, LockBit&#8217;s website <a href="https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/" target="_blank" rel="noopener">was seized by the FBI</a> and the U.K.&#8217;s National Crime Agency (NCA) following a months-long infiltration of the group.</p>
<p>LockBit also tried to restore its reputation on the cybercrime forums by resurrecting itself at a new darknet website, and by threatening to release data from a number of major companies that were hacked by the group in the weeks and days prior to the FBI takedown.</p>
<p>But LockBit appears to have since lost any credibility the group may have once had. After a much-promoted attack on the government of Fulton County, Ga., for example, LockBit threatened to release Fulton County&#8217;s data unless paid a ransom by Feb. 29. But when Feb. 29 rolled around, LockBit <a href="https://krebsonsecurity.com/2024/02/fulton-county-security-experts-call-lockbits-bluff/" target="_blank" rel="noopener">simply deleted the entry for Fulton County from its site</a>, along with those of several financial organizations that had previously been extorted by the group.</p>
<p>Fulton County held a press conference to say that it had not paid a ransom to LockBit, nor had anyone done so on their behalf, and that they were just as mystified as everyone else as to why LockBit never followed through on its threat to publish the county&#8217;s data. Experts told KrebsOnSecurity LockBit likely balked because it was bluffing, and that the FBI likely relieved them of that data in their raid.</p>
<p>Smilyanets&#8217; comments are driven home in revelations first published last month by Recorded Future, which <a href="https://therecord.media/lockbit-lied-about-deleting-exfiltrated-data-after-ransom-payments" target="_blank" rel="noopener">quoted</a> an NCA official as saying LockBit never deleted the data after being paid a ransom, even though that is the only reason many of its victims paid.</p>
<p>&#8220;If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future,&#8221; LockBit&#8217;s extortion notes typically read.</p>
<p>Hopefully, more companies are starting to get the memo that <a href="https://krebsonsecurity.com/2020/11/why-paying-to-delete-stolen-data-is-bonkers/" target="_blank" rel="noopener">paying cybercrooks to delete stolen data</a> is a losing proposition all around.</p>


feed_id: https://krebsonsecurity.com/?p=66598
title: A Close Up Look at the Consumer Data Broker Radaris
uri: A-Close-Up-Look-at-the-Consumer-Data-Broker-Radaris
url: https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/
content:
<p>If you live in the United States, the data broker <strong>Radaris</strong> likely knows a great deal about you, and they are happy to sell what they know to anyone. But how much do we know about Radaris? Publicly available data indicates that in addition to running a dizzying array of people-search websites, the co-founders of Radaris operate multiple Russian-language dating services and affiliate programs. It also appears many of their businesses have ties to a California marketing firm that works with a Russian state-run media conglomerate currently sanctioned by the U.S. government.</p>
<p>Formed in 2009, Radaris is a vast people-search network for finding data on individuals, properties, phone numbers, businesses and addresses. Search for any American&#8217;s name in Google and the chances are excellent that a listing for them at Radaris.com will show up prominently in the results.</p>
<p><img decoding="async" class="aligncenter wp-image-66645" src="media/0fd396fa.radarisbtk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/radarisbtk.png" alt="" width="750" height="564" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/radarisbtk.png 876w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radarisbtk-768x578.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radarisbtk-782x588.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Radaris reports typically bundle a substantial amount of data scraped from public and court documents, including any current or previous addresses and phone numbers, known email addresses and registered domain names. The reports also list address and phone records for the target&#8217;s known relatives and associates. Such information could be useful if you were trying to determine the maiden name of someone&#8217;s mother, or successfully answer a range of other <a href="https://krebsonsecurity.com/tag/knowledge-based-authentication/" target="_blank" rel="noopener">knowledge-based authentication questions</a>.</p>
<p>Currently, consumer reports advertised for sale at Radaris.com are being fulfilled by a different people-search company called <strong>TruthFinder</strong>. But Radaris also operates a number of other people-search properties &#8212; like <strong>Centeda.com</strong> &#8212; that sell consumer reports directly and behave almost identically to TruthFinder: That is, reel the visitor in with promises of detailed background reports on people, and then charge a $34.99 monthly subscription fee just to view the results.</p>
<p>The <strong>Better Business Bureau</strong> (BBB) assigns Radaris a rating of &#8220;F&#8221; for consistently ignoring consumers seeking to have their information removed from Radaris&#8217; various online properties. Of the 159 complaints detailed there in the last year, several were from people who had used third-party identity protection services to have their information removed from Radaris, only to receive a notice a few months later that their Radaris record had been restored.</p>
<p>What&#8217;s more, Radaris&#8217; automated process for requesting the removal of your information requires signing up for an account, potentially providing more information about yourself that the company didn&#8217;t already have (see screenshot above).</p>
<p>Radaris has not responded to requests for comment.</p>
<p>Radaris, TruthFinder and others like them all force users to agree that their reports will not be used to evaluate someone&#8217;s eligibility for credit, or a new apartment or job. This language is so prominent in people-search reports because selling reports for those purposes would classify these firms as consumer reporting agencies (CRAs) and expose them to regulations under the <a href="https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act" target="_blank" rel="noopener">Fair Credit Reporting Act</a> (FCRA).</p>
<p>These data brokers do not want to be treated as CRAs, and for this reason their people search reports typically do not include detailed credit histories, financial information, or full Social Security Numbers (Radaris reports include the first six digits of one&#8217;s SSN).</p>
<p>But in September 2023, the <strong>U.S. Federal Trade Commission</strong> <a href="https://www.ftc.gov/news-events/news/press-releases/2023/09/ftc-says-truthfinder-instant-checkmate-deceived-users-about-background-report-accuracy-violated-fcra" target="_blank" rel="noopener">found</a> that TruthFinder and another people-search service Instant Checkmate were trying to have it both ways. The FTC levied a $5.8 million penalty against the companies for allegedly acting as CRAs because they assembled and compiled information on consumers into background reports that were marketed and sold for employment and tenant screening purposes.</p>
<div id="attachment_66658" style="width: 705px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66658" decoding="async" loading="lazy" class="size-full wp-image-66658" src="media/19142e79.ftc-tfad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/ftc-tfad.png" alt="" width="695" height="283" /><p id="caption-attachment-66658" class="wp-caption-text">An excerpt from the FTC&#8217;s complaint against TruthFinder and Instant Checkmate.</p></div>
<p>The FTC also found TruthFinder and Instant Checkmate deceived users about background report accuracy. The FTC alleges these companies made millions from their monthly subscriptions using push notifications and marketing emails that claimed that the subject of a background report had a criminal or arrest record, when the record was merely a traffic ticket.</p>
<p>&#8220;All the while, the companies touted the accuracy of their reports in online ads and other promotional materials, claiming that their reports contain “the MOST ACCURATE information available to the public,&#8221; the FTC noted. The FTC says, however, that all the information used in their background reports is obtained from third parties that expressly disclaim that the information is accurate, and that TruthFinder and Instant Checkmate take no steps to verify the accuracy of the information.</p>
<p>The FTC said both companies deceived customers by providing &#8220;Remove&#8221; and &#8220;Flag as Inaccurate&#8221; buttons that did not work as advertised. Rather, the &#8220;Remove&#8221; button removed the disputed information only from the report as displayed to that customer; however, the same item of information remained visible to other customers who searched for the same person.</p>
<p>The FTC also said that when a customer flagged an item in the background report as inaccurate, the companies never took any steps to investigate those claims, to modify the reports, or to flag to other customers that the information had been disputed.</p>
<h2>WHO IS RADARIS?</h2>
<p>According to <a href="https://pitchbook.com/profiles/company/62546-05#funding" target="_blank" rel="noopener">Radaris&#8217; profile</a> at the investor website <strong>Pitchbook.com</strong>, the company&#8217;s founder and &#8220;co-chief executive officer&#8221; is a Massachusetts resident named <strong>Gary Norden, </strong>also known as <strong>Gary Nard.</strong></p>
<p>An analysis of email addresses known to have been used by Mr. Norden shows he is a native Russian man whose real name is <strong>Igor</strong><strong> Lybarsky</strong> (also spelled Lubarsky). Igor&#8217;s brother <strong>Dmitry</strong>, who goes by &#8220;Dan,&#8221; appears to be the other co-CEO of Radaris. Dmitry Lybarsky&#8217;s Facebook/Meta account says he was born in March 1963.</p>
<div id="attachment_66640" style="width: 644px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66640" decoding="async" loading="lazy" class="size-full wp-image-66640" src="media/61febc4e.lybarskybros.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/lybarskybros.png" alt="" width="634" height="562" /><p id="caption-attachment-66640" class="wp-caption-text">The Lybarsky brothers Dmitry or &#8220;Dan&#8221; (left) and Igor a.k.a. &#8220;Gary,&#8221; in an undated photo.</p></div>
<p>Indirectly or directly, the Lybarskys <a href="https://medium.com/@deckerthinktank/41-n-main-sherborn-saga-continues-dc23e4d1bebc" target="_blank" rel="noopener">own multiple properties in both Sherborn and Wellesley, Mass</a>. However, the Radaris website is operated by an offshore entity called <strong>Bitseller Expert Ltd</strong>, which is incorporated in Cyprus. Neither Lybarsky brother responded to requests for comment.</p>
<p>A review of the domain names registered by Gary Norden shows that beginning in the early 2000s, he and Dan built an e-commerce empire by marketing prepaid calling cards and VOIP services to Russian expatriates who are living in the United States and seeking an affordable way to stay in touch with loved ones back home.</p>
<div id="attachment_66646" style="width: 679px" class="wp-caption aligncenter"><a href="media/54f3fb43.lybarskyhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/lybarskyhome.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66646" decoding="async" loading="lazy" class="wp-image-66646 size-full" src="media/54f3fb43.lybarskyhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/lybarskyhome.png" alt="" width="669" height="407" /></a><p id="caption-attachment-66646" class="wp-caption-text">A Sherborn, Mass. property owned by Barsky Real Estate Trust and Dmitry Lybarsky.</p></div>
<p>In 2012, the main company in charge of providing those calling services &#8212; Wellesley Hills, Mass-based <strong>Unipoint Technology Inc.</strong> &#8212; was <a href="https://www.fcc.gov/document/unipoint-technologies-notice-apparent-liability-forfeiture" target="_blank" rel="noopener">fined $179,000</a> by the <strong>U.S. Federal Communications Commission</strong>, which said Unipoint never applied for a license to provide international telecommunications services.</p>
<p>DomainTools.com shows the email address <strong>gnard@unipointtech.com</strong> is tied to 137 domains, including radaris.com. DomainTools also shows that the email addresses used by Gary Norden for more than two decades &#8212; <strong>epop@comby.com</strong>, <strong>gary@barksy.com</strong> and <strong>gary1@eprofit.com</strong>, among others &#8212; appear in WHOIS registration records for an entire fleet of people-search websites, including: <strong>centeda.com</strong>, <strong>virtory.com</strong>, <strong>clubset.com</strong>, <strong>kworld.com</strong>, <strong>newenglandfacts.com</strong>, and <strong>pub360.com</strong>.</p>
<p>Still more people-search platforms tied to Gary Norden&#8211; like <strong>publicreports.com</strong> and <strong>arrestfacts.com</strong> &#8212; currently funnel interested customers to third-party search companies, such as TruthFinder and <strong>PersonTrust.com</strong>.</p>
<p>The email addresses used by Gary Nard/Gary Norden are also connected to a slew of data broker websites that sell reports on businesses, real estate holdings, and professionals, including <strong>bizstanding.com</strong>, <strong>homemetry.com</strong>, <strong>trustoria.com</strong>, <strong>homeflock.com</strong>, <strong>rehold.com</strong>, <strong>difive.com</strong> and <strong>projectlab.com</strong>.<span id="more-66598"></span></p>
<h2>AFFILIATE &amp; ADULT</h2>
<p>Domain records indicate that Gary and Dan for many years operated <a href="https://web.archive.org/web/20110305043821/http://www.affiliate.ru/Program/Telecommunications/214/Comfi" target="_blank" rel="noopener">a now-defunct pay-per-click affiliate advertising network</a> called <strong>affiliate.ru</strong>. That entity used domain name servers tied to the aforementioned domains comby.com and eprofit.com, as did <strong>radaris.ru</strong>.</p>
<div id="attachment_66647" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66647" decoding="async" loading="lazy" class="wp-image-66647" src="media/e003cf1f.affiliate-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/affiliate-ru.png" alt="" width="750" height="615" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/affiliate-ru.png 944w, https://krebsonsecurity.com/wp-content/uploads/2024/03/affiliate-ru-768x630.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/affiliate-ru-782x641.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66647" class="wp-caption-text">A machine-translated version of Affiliate.ru, a Russian-language site that advertised hundreds of money making affiliate programs, including the Comfi.com prepaid calling card affiliate.</p></div>
<p>Comby.com used to be a Russian language social media network that looked a great deal like Facebook. The domain now forwards visitors to <strong>Privet.ru</strong> (&#8220;hello&#8221; in Russian), a dating site that claims to have 5 million users. Privet.ru says it belongs to a company called <strong>Dating Factory</strong>, which lists offices in Switzerland. Privet.ru uses the Gary Norden domain eprofit.com for its domain name servers.</p>
<p>Dating Factory&#8217;s website says it sells &#8220;powerful dating technology&#8221; to help customers create unique or niche dating websites. A review of the sample images available on the Dating Factory homepage suggests the term &#8220;dating&#8221; in this context refers to adult websites. Dating Factory also operates a community called <strong>FacebookOfSex</strong>, as well as the domain <strong>analslappers.com</strong>.</p>
<h2>RUSSIAN AMERICA</h2>
<p>Email addresses for the Comby and Eprofit domains indicate Gary Norden operates an entity in Wellesley Hills, Mass. called <strong>RussianAmerican Holding Inc</strong>. (russianamerica.com). This organization is listed as the owner of the domain <strong>newyork.ru</strong>, which is a site dedicated to orienting newcomers from Russia to the Big Apple.</p>
<p>Newyork.ru&#8217;s terms of service refer to an international calling card company called ComFi Inc. (<a href="https://www.bbb.org/us/ma/newton/profile/prepaid-phone-card/comficom-0021-1258/complaints" target="_blank" rel="noopener">comfi.com</a>) and list an address as <strong>PO Box 81362 Wellesley Hills, Ma</strong>. Other sites that include this address are russianamerica.com, <strong>russianboston.com</strong>, <strong>russianchicago.com</strong>,<strong> russianla.com</strong>, <strong>russiansanfran.com</strong>, <strong>russianmiami.com</strong>, <strong>russiancleveland.com</strong> and <strong>russianseattle.com</strong> (currently offline).</p>
<p>ComFi is tied to <strong>Comfibook.com</strong>, which was a search aggregator website that collected and published data from many online and offline sources, including phone directories, social networks, online photo albums, and public records.</p>
<div id="attachment_66659" style="width: 775px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66659" decoding="async" loading="lazy" class="size-full wp-image-66659" src="media/a8104f7a.russianamericahome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/russianamericahome.png" alt="" width="765" height="764" /><p id="caption-attachment-66659" class="wp-caption-text">The current website for russianamerica.com. Note the ad in the bottom left corner of this image for Channel One, a Russian state-owned media firm that is currently sanctioned by the U.S. government.</p></div>
<h2>AMERICAN RUSSIAN MEDIA</h2>
<p>Many of the U.S. city-specific online properties apparently tied to Gary Norden include phone numbers on their contact pages for a pair of Russian media and advertising firms based in southern California. The phone number <strong>323-874-8211</strong> appears on the websites russianla.com, russiasanfran.com, and <strong>rosconcert.com</strong>, which sells tickets to theater events performed in Russian.</p>
<p>Historic domain registration records from DomainTools show rosconcert.com was registered in 2003 to Unipoint Technologies &#8212; the same company fined by the FCC for not having a license. Rosconcert.com also lists the phone number <strong>818-377-2101</strong>.</p>
<p>A phone number just a few digits away &#8212; <strong>323-874-8205</strong> &#8212; appears as a point of contact on newyork.ru, russianmiami.com, russiancleveland.com, and russianchicago.com. A search in Google shows this 82xx number range &#8212; and the 818-377-2101 number &#8212; belong to two different entities at the same UPS Store mailbox in Tarzana, Calif: <strong>American Russian Media Inc.</strong> (<strong>armediacorp.com</strong>), and <strong>Lamedia.biz</strong>.</p>
<p>Armediacorp.com is the home of <strong>FACT Magazine</strong>, a glossy Russian-language publication put out jointly by the American-Russian Business Council, the Hollywood Chamber of Commerce, and the West Hollywood Chamber of Commerce.</p>
<p>Lamedia.biz says it is an international media organization with more than 25 years of experience within the Russian-speaking community on the West Coast. The site advertises FACT Magazine and the Russian state-owned media outlet <strong>Channel One</strong>. Clicking the Channel One link on the homepage shows Lamedia.biz offers to submit advertising spots that can be shown to Channel One viewers. The price for a basic ad is listed at $500.</p>
<p>In May 2022, the U.S. government <a href="https://home.treasury.gov/news/press-releases/jy0771" target="_blank" rel="noopener">levied financial sanctions against Channel One </a>that bar US companies or citizens from doing business with the company.</p>
<div id="attachment_66657" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66657" decoding="async" loading="lazy" class=" wp-image-66657" src="media/0c1f55ff.la-media-biz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/la-media-biz.png" alt="" width="749" height="538" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/la-media-biz.png 1252w, https://krebsonsecurity.com/wp-content/uploads/2024/03/la-media-biz-768x551.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/la-media-biz-782x562.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66657" class="wp-caption-text">The website of lamedia.biz offers to sell advertising on two Russian state-owned media firms currently sanctioned by the U.S. government.</p></div>
<h2>LEGAL ACTIONS AGAINST RADARIS</h2>
<p>In 2014, a group of people <a href="https://www.courtlistener.com/docket/5969712/huebner-v-radaris-llc/" target="_blank" rel="noopener">sued Radaris in a class-action lawsuit</a> claiming the company&#8217;s practices violated the Fair Credit Reporting Act. Court records indicate the defendants never showed up in court to dispute the claims, and as a result the judge eventually awarded the plaintiffs a default judgement and ordered the company to pay $7.5 million.</p>
<p>But the plaintiffs in that civil case had a difficult time collecting on the court&#8217;s ruling. In response, the court ordered the radaris.com domain name (~9.4M monthly visitors) to be handed over to the plaintiffs.</p>
<p>However, in 2018 Radaris was able to reclaim their domain on a technicality. Attorneys for the company argued that their clients were never named as defendants in the original lawsuit, and so their domain could not legally be taken away from them in a civil judgment.</p>
<p>&#8220;Because our clients were never named as parties to the litigation, and were never served in the litigation, the taking of their property without due process is a violation of their rights,&#8221; Radaris&#8217; attorneys argued.</p>
<p>In October 2023, an Illinois resident filed <a href="https://s3.amazonaws.com/jnswire/jns-media/80/59/13728704 /2023CH08949.pdf" target="_blank" rel="noopener">a class-action lawsuit</a> against Radaris for allegedly using people’s names for commercial purposes, in violation of the <a href="https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2241&amp;ChapterID=62" target="_blank" rel="noopener">Illinois Right of Publicity Act</a>.</p>
<p>On Feb. 8, 2024, a company called <strong>Atlas Data Privacy Corp.</strong> <a href="https://trellis.law/case/34023/midl000847-24/atlas-data-privacy-c-orporatio-vs-radaris-llc" target="_blank" rel="noopener">sued Radaris LLC</a> for allegedly violating &#8220;<a href="https://www.nj.gov/dca/oip/" target="_blank" rel="noopener">Daniel&#8217;s Law</a>,&#8221; a statute that allows New Jersey law enforcement, government personnel, judges and their families to have their information completely removed from people-search services and commercial data brokers. Atlas <a href="https://trellis.law/cases/%22atlas-data-privacy-corporation%22?state=nj" target="_blank" rel="noopener">has filed at least 140 similar Daniel&#8217;s Law complaints</a> against data brokers recently.</p>
<p>Daniel&#8217;s Law was enacted in response to the death of 20-year-old Daniel Anderl, who was killed in a violent attack targeting a federal judge (his mother). In July 2020, a disgruntled attorney who had appeared before U.S. District Judge Esther Salas <a href="https://www.nj.com/middlesex/2020/07/manhunt-underway-for-gunman-dressed-as-fedex-driver-who-killed-federal-judges-son-wounded-husband.html" target="_blank" rel="noopener">disguised himself as a Fedex driver</a>, went to her home and shot and killed her son (the judge was unharmed and the assailant killed himself).</p>
<p>Earlier this month, <a href="https://therecord.media/new-jersey-law-enforcement-lawsuit-lexisnexis-data" target="_blank" rel="noopener">The Record</a> reported on Atlas Data Privacy&#8217;s lawsuit against LexisNexis Risk Data Management, in which the plaintiffs representing thousands of law enforcement personnel in New Jersey alleged that after they asked for their information to remain private, the data broker retaliated against them by freezing their credit and falsely reporting them as identity theft victims.</p>
<p>Another data broker sued by Atlas Data Privacy &#8212; pogodata.com &#8212; <a href="https://pogodata.org/" target="_blank" rel="noopener">announced on Mar. 1</a> that it was likely shutting down because of the lawsuit.</p>
<p>&#8220;The matter is far from resolved but your response motivates us to try to bring back most of the names while preserving redaction of the 17,000 or so clients of the redaction company,&#8221; the company wrote. &#8220;While little consolation, we are not alone in the suit &#8211; the privacy company sued 140 property-data sites at the same time as PogoData.&#8221;</p>
<p>Atlas says their goal is convince more states to pass similar laws, and to extend those protections to other groups such as teachers, healthcare personnel and social workers. Meanwhile, media law experts say they&#8217;re concerned that enacting Daniel&#8217;s Law in other states would limit the ability of journalists to hold public officials accountable, and allow authorities <a href="https://newjerseymonitor.com/2023/09/21/judge-declines-to-limit-daniels-law-for-reporters/" target="_blank" rel="noopener">to pursue criminals charges against media outlets</a> that publish the same type of public and governments records that fuel the people-search industry.</p>
<h2>PEOPLE-SEARCH CARVE-OUTS</h2>
<p>There are some pending changes to the US legal and regulatory landscape that could soon reshape large swaths of the data broker industry. But experts say it is unlikely that any of these changes will affect people-search companies like Radaris.</p>
<p>On Feb. 28, 2024, the White House issued an executive order that directs the <strong>U.S. Department of Justice</strong> (DOJ) to create regulations that would prevent data brokers from selling or transferring abroad certain data types deemed too sensitive, including genomic and biometric data, geolocation and financial data, as well as other as-yet unspecified personal identifiers. The DOJ this week <a href="https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and" target="_blank" rel="noopener">published a list of more than 100 questions</a> it is seeking answers to regarding the data broker industry.</p>
<p>In August 2023, the <strong>Consumer Financial Protection Bureau</strong> (CFPB) <a href="https://www.mayerbrown.com/en/insights/publications/2023/10/cfpb-initiates-fair-credit-reporting-act-rulemaking-focusing-on-data-brokers" target="_blank" rel="noopener">announced</a> it was undertaking new rulemaking related to data brokers.</p>
<p><strong>Justin Sherman</strong>, an adjunct professor at <strong>Duke University</strong>, said neither the CFPB nor White House rulemaking will likely address people-search brokers because these companies typically get their information by scouring federal, state and local government records. Those government files include voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more.</p>
<p>&#8220;These dossiers contain everything from individuals’ names, addresses, and family information to data about finances, criminal justice system history, and home and vehicle purchases,&#8221; Sherman <a href="https://www.lawfaremedia.org/article/people-search-data-brokers-stalking-and-publicly-available-information-carve-outs" target="_blank" rel="noopener">wrote</a> in an October 2023 article for Lawfare. &#8220;People search websites’ business pitch boils down to the fact that they have done the work of compiling data, digitizing it, and linking it to specific people so that it can be searched online.&#8221;</p>
<p>Sherman said while there are ongoing debates about whether people search data brokers have legal responsibilities to the people about whom they gather and sell data, the sources of this information &#8212; public records &#8212; are completely carved out from every single state consumer privacy law.</p>
<p>&#8220;Consumer privacy laws in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia all contain highly similar or completely identical carve-outs for &#8216;publicly available information&#8217; or government records,&#8221; Sherman wrote. &#8220;Tennessee’s consumer data privacy law, for example, stipulates that “personal information,” a cornerstone of the legislation, does not include &#8216;publicly available information,&#8217; defined as:</p>
<blockquote><p>&#8220;&#8230;information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.&#8221;</p></blockquote>
<p>Sherman said this is the same language as the carve-out in the California privacy regime, which is often held up as the national leader in state privacy regulations. He said with a limited set of exceptions for survivors of stalking and domestic violence, even under California’s newly passed Delete Act — which creates a centralized mechanism for consumers to ask some third-party data brokers to delete their information — consumers across the board cannot exercise these rights when it comes to data scraped from property filings, marriage certificates, and public court documents, for example.</p>
<p>&#8220;With some very narrow exceptions, it&#8217;s either extremely difficult or impossible to compel these companies to remove your information from their sites,&#8221; Sherman told KrebsOnSecurity. &#8220;Even in states like California, every single consumer privacy law in the country completely exempts publicly available information.&#8221;</p>
<p>Below is a mind map that helped KrebsOnSecurity track relationships between and among the various organizations named in the story above:</p>
<div id="attachment_66716" style="width: 761px" class="wp-caption aligncenter"><a href="media/721990b2.radaris-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66716" decoding="async" loading="lazy" class="wp-image-66716" src="media/721990b2.radaris-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm.png" alt="" width="751" height="332" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm.png 1714w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-768x340.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-1536x679.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-782x346.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-66716" class="wp-caption-text">A mind map of various entities apparently tied to Radaris and the company&#8217;s co-founders. Click to enlarge.</p></div>


