# articles

feed_id: https://krebsonsecurity.com/?p=57964
title: Happy 12th Birthday, KrebsOnSecurity.com!
uri: Happy-12th-Birthday-KrebsOnSecurity-com
url: https://krebsonsecurity.com/2021/12/happy-12th-birthday-krebsonsecurity-com/
content:
<p><img loading="lazy" class="aligncenter wp-image-57982" src="media/7e62ca94.12street.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/12street.png" alt="" width="760" height="441" /><br />
KrebsOnSecurity.com celebrates its 12th anniversary today! Maybe &#8220;celebrate&#8221; is too indelicate a word for a year wracked by the global pandemics of COVID-19 and ransomware. Especially since stories about both have helped to grow the audience here tremendously in 2021. But this site&#8217;s birthday also is a welcome opportunity to thank you all for your continued readership and support, which helps keep the content here free to everyone.</p>
<p>More than seven million unique visitors came to KrebsOnSecurity.com in 2021, generating some 12 million+ pageviews and leaving almost 8,000 comments. We also now have nearly 50,000 subscribers to <a href="https://krebsonsecurity.com/subscribe/" target="_blank" rel="noopener">our email newsletter</a>, which is still just a text-based (non-HTML) email that goes out each time a new story is published here (~2-3 times a week).</p>
<p>Back when this site first began 12 years ago, I never imagined it would attract such a level of engagement. Before launching KrebsOnSecurity, I was a tech reporter for washingtonpost.com. For many years, The Post&#8217;s website was physically, financially and editorially separate from what the dot-com employees affectionately called &#8220;The Dead Tree Edition.&#8221; When the two newsrooms finally merged in 2009, my position was eliminated.</p>
<p>Happily, the blog I authored for four years at washingtonpost.com &#8212; Security Fix &#8212; had attracted a sizable readership, and it seemed clear that the worldwide appetite for in-depth news about computer security and cybercrime would become practically insatiable in the coming years.</p>
<p>Happier still, The Post offered a severance package equal to six months of my salary. Had they not thrown that lifeline, I doubt I&#8217;d have had the guts to go it alone. But at the time, my wife basically said I had six months to make this &#8220;blog thing&#8221; work, or else find a &#8220;real job.&#8221;</p>
<p>God bless her eternal patience with my adopted occupation, because KrebsOnSecurity has helped me avoid finding a real job for a dozen years now. And hopefully they let me keep doing this, because at this point I&#8217;m certainly unqualified to do much else.</p>
<p>I&#8217;d be remiss if I didn&#8217;t take this opportunity to remind Dear Readers that advertisers do help keep the content free here to everyone. For security and privacy reasons, KrebsOnSecurity does not host any third-party content on this site &#8212; and this includes the ad creatives, which are simply images or GIFs vetted by Yours Truly and served directly from krebsonsecurity.com.</p>
<p>That&#8217;s a long-winded way of asking: If you regularly visit KrebsOnSecurity.com with an ad blocker, please consider adding an exception for this site.</p>
<p>Thanks again, Dear Readers. Please stay safe, healthy and alert in 2022. See you on the other side!</p>


feed_id: https://krebsonsecurity.com/?p=57993
title: Norton 360 Now Comes With a Cryptominer
uri: Norton-360-Now-Comes-With-a-Cryptominer
url: https://krebsonsecurity.com/2022/01/norton-360-now-comes-with-a-cryptominer/
content:
<p><strong>Norton 360</strong>, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers&#8217; computers. Norton&#8217;s parent firm says the cloud-based service that activates the program and allows customers to profit from the scheme &#8212; in which the company keeps 15 percent of any currencies mined &#8212; is &#8220;opt-in,&#8221; meaning users have to agree to enable it. But many Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, &#8220;Dude, where&#8217;s my crypto?&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-57997" src="media/0b1e5ce1.nortoncrypto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto.png" alt="" width="761" height="488" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto.png 1048w, https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto-768x493.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto-782x502.png 782w" sizes="(max-width: 761px) 100vw, 761px" /></p>
<p>Norton 360 is owned by Tempe, Ariz.-based <strong>NortonLifeLock Inc</strong>. In 2017, the identity theft protection company <strong>LifeLock</strong> was acquired by <strong>Symantec Corp.</strong>, which was renamed to NortonLifeLock in 2019 (LifeLock is now included in the Norton 360 service).</p>
<p>According to <a href="https://community.norton.com/en/forums/faq-norton-crypto" target="_blank" rel="noopener">the FAQ posted on its site</a>, &#8220;<strong>Norton Crypto</strong>&#8221; will mine <a href="https://en.wikipedia.org/wiki/Ethereum" target="_blank" rel="noopener">Ethereum</a> (ETH) cryptocurrency while the customer&#8217;s computer is idle. The FAQ also says Norton Crypto will only run on systems that meet certain hardware and software requirements (such as an NVIDIA graphics card with at least 6 GB of memory).</p>
<p>&#8220;Norton creates a secure digital Ethereum wallet for each user,&#8221; the FAQ reads. &#8220;The key to the wallet is encrypted and stored securely in the cloud. Only you have access to the wallet.&#8221;</p>
<p>NortonLifeLock began offering the mining service in July 2021, but the program gained broader attention on Jan. 4 when <a href="https://boingboing.net/" target="_blank" rel="noopener">Boing Boing</a> co-editor <strong>Cory Doctorow</strong> <a href="https://twitter.com/doctorow/status/1478479483585933312">tweeted</a> that NortonCrypto would run by default for Norton 360 users.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-57995" src="media/59df4891.cdtweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/cdtweet.png" alt="" width="588" height="402" /></p>
<p>NortonLifeLock says Norton Crypto is an opt-in feature only and is not enabled without user permission.</p>
<p>&#8220;If users have turned on Norton Crypto but no longer wish to use the feature, it can be disabled by temporarily shutting off &#8216;tamper protection&#8217; (which allows users to modify the Norton installation) and deleting NCrypt.exe from your computer,&#8221; NortonLifeLock said in a written statement. However, many users <a href="https://www.digitaltrends.com/computing/no-easy-way-to-uninstall-norton-crypto/" target="_blank" rel="noopener">have reported difficulty removing the mining program</a>.</p>
<p>From reading user posts on the Norton Crypto community forum, it seems some longtime Norton customers were horrified at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.</p>
<p>&#8220;How on Earth could anyone at Norton think that adding crypto mining within a security product would be a good thing?,&#8221; reads <a href="https://community.norton.com/en/comment/8518793#comment-8518793" target="_blank" rel="noopener">a Dec. 28 thread</a> titled &#8220;Absolutely furious.&#8221;</p>
<p>&#8220;Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,&#8221; the post reads. &#8220;The product people need firing. What&#8217;s the next &#8216;bright idea&#8217;? Norton Botnet? &#8216; And I was just about to re-install Norton 360 too, but this has literally has caused me to no longer trust Norton and their direction.&#8221;<span id="more-57993"></span></p>
<p>It&#8217;s an open question whether Norton Crypto users can expect to see much profit from participating in this scheme, at least in the short run. Mining cryptocurrencies basically involves using your computer&#8217;s spare resources to help validate financial transactions of other crypto users. Crypto mining causes one&#8217;s computer to draw more power, which can increase one&#8217;s overall electricity costs.</p>
<p>&#8220;Norton is pretty much amplifying energy consumption worldwide, costing their customers more in electricity use than the customer makes on the mining, yet allowing Norton to make a ton of profit,&#8221; <a href="https://twitter.com/VickerySec/status/1478937736325197824" target="_blank" rel="noopener">tweeted</a> security researcher <strong>Chris Vickery</strong>. &#8220;It&#8217;s disgusting, gross, and brand-suicide.&#8221;</p>
<p>Then there&#8217;s the matter of getting paid. Norton Crypto lets users withdraw their earnings to an account at cryptocurrency platform CoinBase, but as Norton Crypto&#8217;s FAQ rightly points out, there are coin mining fees as well as transaction costs to transfer Ethereum.</p>
<p>&#8220;The coin mining fee is currently 15% of the crypto allocated to the miner,&#8221; the FAQ explains. &#8220;Transfers of cryptocurrencies may result in transaction fees (also known as &#8220;gas&#8221; fees) paid to the users of the cryptocurrency blockchain network who process the transaction. In addition, if you choose to exchange crypto for another currency, you may be required to pay fees to an exchange facilitating the transaction. Transaction fees fluctuate due to cryptocurrency market conditions and other factors. These fees are not set by Norton.&#8221;</p>
<p>Which might explain why so many Norton Crypto users have taken to the community&#8217;s online forum to complain they were having trouble withdrawing their earnings. Those gas fees are the same regardless of the amount of crypto being moved, so the system simply blocks withdrawals if the amount requested can&#8217;t cover the transfer fees.</p>
<p>I guess what bothers me most about Norton Crypto is that it will be introducing millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of unique security and privacy challenges that require users to &#8220;level up&#8221; their personal security practices in fairly significant ways.</p>
<p>Several of my elder family members and closest friends are longtime Norton users who renew their subscription year after year (despite my reminding them that it&#8217;s way cheaper just to purchase it again each year as a new user). None of them are particularly interested in or experts at securing their computers and digital lives, and the thought of them opening CoinBase accounts and navigating that space is terrifying.</p>
<p>Big Yellow is not the only brand that&#8217;s cashing in on investor fervor over cryptocurrencies and hoping to appeal to a broader (or maybe just older) audience: The venerable electronics retailer <strong>RadioShack</strong>, which relaunched in 2020 as an online-focused brand, now says it plans to chart a future as a cryptocurrency exchange.</p>
<p>&#8220;RadioShack’s argument is basically that as a very old brand, it’s primed to sell old CEOs on cryptocurrency,&#8221; <a href="https://www.theverge.com/2021/12/22/22849943/radioshack-defi-cryptocurrency-radio-token-launch" target="_blank" rel="noopener">writes</a> <strong>Adi Robertson</strong> for <em>The Verge</em>.</p>
<p>&#8220;Too many [cryptocurrency companies] focused on speculation and not enough on making the ‘old-school’ customer feel comfortable,” the company’s website states, claiming that the average &#8220;decision-making&#8221; corporate CEO is 68 years old. &#8220;The older generation simply doesn’t trust the new-fangled ideas of the Bitcoin youth.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58020
title: 500M Avira Antivirus Users Introduced to Cryptomining
uri: 500M-Avira-Antivirus-Users-Introduced-to-Cryptomining
url: https://krebsonsecurity.com/2022/01/500m-avira-antivirus-users-introduced-to-cryptomining/
content:
<p>Many readers were surprised to learn recently that the popular <strong>Norton 360</strong> antivirus suite now ships with a program which lets customers <a href="https://krebsonsecurity.com/2022/01/norton-360-now-comes-with-a-cryptominer/" target="_blank" rel="noopener">make money mining virtual currency</a>. But Norton 360 isn&#8217;t alone in this dubious endeavor: <strong>Avira</strong> antivirus &#8212; which has built a base of 500 million users worldwide largely by making the product free &#8212; was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called <strong>Avira Crypto</strong>.</p>
<div id="attachment_58028" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58028" loading="lazy" class=" wp-image-58028" src="media/f4a6657e.aviracrypto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto.png" alt="" width="752" height="507" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto.png 1110w, https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto-768x518.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto-782x527.png 782w" sizes="(max-width: 752px) 100vw, 752px" /><p id="caption-attachment-58028" class="wp-caption-text">Avira Crypto</p></div>
<p>Founded in 2006, <a href="https://en.wikipedia.org/wiki/Avira" target="_blank" rel="noopener">Avira Operations GmbH &amp; Co. KG</a> is a German multinational software company best known for their Avira Free Security (a.k.a. Avira Free Antivirus). In January 2021, Avira was acquired by Tempe, Ariz.-based <strong>NortonLifeLock Inc</strong>., the same company that now owns Norton 360.</p>
<p>In 2017, the identity theft protection company <strong>LifeLock</strong> was acquired by <strong>Symantec Corp.</strong>, which was renamed to NortonLifeLock in 2019. LifeLock is now included in the Norton 360 service; Avira offers users a similar service called Breach Monitor.</p>
<p>Like Norton 360, Avira comes with a cryptominer already installed, but customers have to opt in to using the service that powers it. Avira&#8217;s <a href="https://support.avira.com/hc/en-us/articles/4407469485585-What-is-Avira-Crypto-" target="_blank" rel="noopener">FAQ on its cryptomining service</a> is somewhat sparse. For example, it doesn&#8217;t specify how much NortonLifeLock gets out of the deal (NortonLifeLock keeps 15 percent of any cryptocurrency mined by Norton Crypto).</p>
<p>&#8220;Avira Crypto allows you to use your computer&#8217;s idle time to mine the cryptocurrency Ethereum (ETH),&#8221; the FAQ explains. &#8220;Since cryptomining requires a high level of processing power, it is not suitable for users with an average computer. Even with compatible hardware, mining cryptocurrencies on your own can be less rewarding. Your best option is to join a mining pool that shares their computer power to improve their chance of mining cryptocurrency. The rewards are then distributed evenly to all members in the pool.&#8221;</p>
<p>NortonLifeLock hasn&#8217;t yet responded to requests for comment, so it&#8217;s unclear whether Avira uses the same cryptomining code as Norton Crypto. But there are clues that suggest that&#8217;s the case. NortonLifeLock <a href="https://www.avira.com/en/blog/avira-unveils-extended-features-with-avira-crypto-game-booster-and-breach-monitor" target="_blank" rel="noopener">announced Avira Crypto in late October 2021</a>, but multiple other antivirus products have flagged Avira&#8217;s installer as malicious or unsafe for including a cryptominer as far back as Sept. 9, 2021.</p>
<div id="attachment_58036" style="width: 764px" class="wp-caption aligncenter"><a href="media/44ad5425.avira-vt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58036" loading="lazy" class="wp-image-58036" src="media/44ad5425.avira-vt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt.png" alt="" width="754" height="378" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt.png 1385w, https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt-768x385.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt-782x392.png 782w" sizes="(max-width: 754px) 100vw, 754px" /></a><p id="caption-attachment-58036" class="wp-caption-text">Avira was detected as potentially unsafe for including a cryptominer back in Sept. 2021. Image: Virustotal.com.</p></div>
<p>The above screenshot was taken on <a href="https://www.virustotal.com" target="_blank" rel="noopener">Virustotal.com</a>, a service owned by Google that scans submitted files against dozens of antivirus products. The detection report pictured was found by searching Virustotal for &#8220;ANvOptimusEnablementCuda,&#8221; a function included in the Norton Crypto mining component &#8220;Ncrypt.exe.&#8221;<span id="more-58020"></span></p>
<p>Some longtime Norton customers took to NortonLifeLock&#8217;s online forum to express horror at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.</p>
<p>&#8220;Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,” reads a Dec. 28 thread on Norton&#8217;s forum titled &#8220;Absolutely furious.&#8221;</p>
<p>Others have charged that the crypto offering will end up costing customers more in electricity bills than they can ever hope to gain from letting their antivirus mine ETH. What&#8217;s more, there are hefty fees involved in moving any ETH mined by Norton or Avira Crypto to an account that the user can cash out, and many users apparently don&#8217;t understand they can&#8217;t cash out until they at least earn enough ETH to cover the fees.</p>
<p>In August 2021, NortonLifeLock <a href="https://investor.nortonlifelock.com/About/Investors/press-releases/press-release-details/2021/NortonLifeLock-and-Avast-to-Merge-to-Lead-the-Transformation-of-Consumer-Cyber-Safety/default.aspx" target="_blank" rel="noopener">said it had reached an agreement</a> to acquire <strong>Avast</strong>, another longtime free antivirus product that also claims to have around 500 million users. It remains to be seen whether Avast Crypto will be the next brilliant offering from NortonLifeLock.</p>
<p>As mentioned in this week&#8217;s story on Norton Crypto, I get that participation in these cryptomining schemes is voluntary, but much of that ultimately hinges on how these crypto programs are pitched and whether users really understand what they&#8217;re doing when they enable them. But what bugs me most is they will be introducing hundreds of millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of <a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">unique security and privacy challenges</a> that require users to “level up” their personal security practices in fairly significant ways.</p>


feed_id: https://krebsonsecurity.com/?p=58072
title: ‘Wormable’ Flaw Leads January 2022 Patch Tuesday
uri: Wormable-Flaw-Leads-January-2022-Patch-Tuesday
url: https://krebsonsecurity.com/2022/01/wormable-flaw-leads-january-2022-patch-tuesday/
content:
<p><strong>Microsoft</strong> today released updates to plug nearly 120 security holes in <strong>Windows</strong> and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is &#8220;wormable,&#8221; meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="746" height="545" /></p>
<p>Nine of the vulnerabilities fixed in this month&#8217;s Patch Tuesday received Microsoft&#8217;s &#8220;critical&#8221; rating, meaning malware or miscreants can exploit them to gain remote access to vulnerable Windows systems through no help from the user.</p>
<p>By all accounts, the most severe flaw addressed today is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907" target="_blank" rel="noopener">CVE-2022-21907,</a> a critical, remote code execution flaw in the &#8220;<strong>HTTP Protocol Stack</strong>.&#8221; Microsoft says the flaw affects <strong>Windows 10</strong> and <strong>Windows 11</strong>, as well as <strong>Server 2019</strong> and <strong>Server 2022</strong>.</p>
<p>&#8220;While this is definitely more server-centric, remember that Windows clients can also run http.sys, so all affected versions are affected by this bug,&#8221; said <strong>Dustin Childs</strong> from <strong>Trend Micro&#8217;s Zero Day Initiative</strong>. &#8220;Test and deploy this patch quickly.&#8221;</p>
<p>Quickly indeed. In May 2021, Microsoft patched a similarly critical and wormable vulnerability in the HTTP Protocol Stack; less than a week later, computer code made to exploit the flaw <a href="https://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/" target="_blank" rel="noopener">was posted online</a>.</p>
<p>Microsoft also fixed three more remote code execution flaws in <strong>Exchange Server</strong>, a technology that hundreds of thousands of organizations worldwide use to manage their email. Exchange flaws are a major target of malicious hackers. Almost a year ago, hundreds of thousands of Exchange servers worldwide were compromised by malware after attackers started mass-exploiting four zero-day flaws in Exchange.</p>
<p>Microsoft says the limiting factor with these three newly found Exchange flaws is that an attacker would need to be tied to the target&#8217;s network somehow to exploit them. But <strong>Satnam Narang</strong> at <strong>Tenable</strong> notes Microsoft has labeled all three Exchange flaws as &#8220;exploitation more likely.&#8221;</p>
<p>&#8220;One of the flaws, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21846" target="_blank" rel="noopener">CVE-2022-21846</a>, was disclosed to Microsoft by the <strong>National Security Agency</strong>,&#8221; Narang said. &#8220;Despite the rating, Microsoft notes the attack vector is adjacent, meaning exploitation will require more legwork for an attacker, unlike the ProxyLogon and ProxyShell vulnerabilities which were remotely exploitable.&#8221;<span id="more-58072"></span></p>
<p>Security firm <strong>Rapid7</strong> points out that roughly a quarter of the security updates this month address vulnerabilities in Microsoft&#8217;s <strong>Edge</strong> browser via Chromium.</p>
<p>&#8220;None of these have yet been seen exploited in the wild, though six were publicly disclosed prior to today,&#8221; Rapid7&#8217;s <strong>Greg Wiseman</strong> said. &#8220;This includes two Remote Code Execution vulnerabilities affecting open source libraries that are bundled with more recent versions of Windows: <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-22947" target="_blank" rel="noopener">CVE-2021-22947</a>, which affects the curl library, and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36976" target="_blank" rel="noopener">CVE-2021-36976</a> which affects libarchive.&#8221;</p>
<p>Wiseman said slightly less scary than the HTTP Protocol Stack vulnerability is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21840" target="_blank" rel="noopener">CVE-2022-21840</a>, which affects all supported versions of Office, as well as Sharepoint Server.</p>
<p>&#8220;Exploitation would require social engineering to entice a victim to open an attachment or visit a malicious website,&#8221; he said. &#8220;Thankfully the Windows preview pane is not a vector for this attack.&#8221;</p>
<p>Other patches include fixes for <strong>.NET Framework</strong>, <strong>Microsoft Dynamics</strong>, <strong>Windows Hyper-V</strong>, <strong>Windows Defender</strong>, and the <strong>Windows Remote Desktop Protocol</strong> (RDP). As usual, the <strong>SANS Internet Storm Center</strong> has a <a href="https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+January+2022/28230/" target="_blank" rel="noopener">per-patch breakdown by severity and impact</a>.</p>
<p>Standard disclaimer: Before you update Windows, <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.</p>


feed_id: https://krebsonsecurity.com/?p=58018
title: Who is the Network Access Broker ‘Wazawaka?’
uri: Who-is-the-Network-Access-Broker-Wazawaka
url: https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/
content:
<p>In a great many ransomware attacks, the criminals who pillage the victim&#8217;s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by &#8220;<strong>Wazawaka</strong>,&#8221; the hacker handle chosen by a major access broker in the Russian-speaking cybercrime scene.</p>
<p><img loading="lazy" class="aligncenter wp-image-58061" src="media/f572f658.wbrkb.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wbrkb.jpg" alt="" width="773" height="516" /></p>
<p>Wazawaka has been a highly active member of multiple cybercrime forums over the past decade, but his favorite is the Russian-language community <strong>Exploit</strong>. Wazawaka spent his early days on Exploit and other forums selling distributed denial-of-service (DDoS) attacks that could knock websites offline for about USD $80 a day. But in more recent years, Wazawaka has focused on peddling access to organizations and to databases stolen from hacked companies.</p>
<p>&#8220;Come, rob, and get dough!,&#8221; reads a thread started by Wazawaka on Exploit in March 2020, in which he sold access to a Chinese company with more than $10 billion in annual revenues. &#8220;Show them who is boss.&#8221;</p>
<p>According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including <strong>LockBit. </strong>Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.</p>
<p>Wazawaka also said he&#8217;d teamed up with <a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener"><strong>DarkSide</strong></a>, the ransomware affiliate group responsible for <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the six-day outage</a> at <strong>Colonial Pipeline</strong> last year that caused nationwide fuel shortages and price spikes. The <strong>U.S. Department of State</strong> has since offered a $5 million reward for information leading to the arrest and conviction of any DarkSide affiliates.</p>
<p>Wazawaka seems to have adopted the uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder &#8212; not privately sold to the highest bidder. In thread after thread on the crime forum <strong>XSS</strong>, Wazawaka&#8217;s alias &#8220;<strong>Uhodiransomwar</strong>&#8221; can be seen posting download links to databases from companies that have refused to negotiate after five days.</p>
<p>&#8220;The only and the main principle of ransomware is: the information that you steal should never be sold,&#8221; Uhodiransomwar wrote in August 2020. &#8220;The community needs to receive it absolutely free of charge if the ransom isn&#8217;t paid by the side that this information is stolen from.&#8221;</p>
<p>Wazawaka hasn&#8217;t always been so friendly to other cybercrooks. Over the past ten years, his contact information has been used to register numerous phishing domains intended to siphon credentials from people trying to transact on various dark web marketplaces. In 2018, Wazawaka registered a slew of domains spoofing the real domain for the <strong>Hydra</strong> dark web market. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.</p>
<p>&#8220;I used to steal their QIWI accounts with up to $500k in them,&#8221; Wazawaka recalled. &#8220;A dealer would never go to the cops and tell them he was selling stuff online and someone stole his money.&#8221;<span id="more-58018"></span></p>
<h2>WHO IS WAZAWAKA?</h2>
<p>Wazawaka used multiple email addresses and nicknames on several Russian crime forums, but data collected by cybersecurity firm <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> show that Wazawaka&#8217;s alter egos always used one of three fairly unique passwords: <strong>2k3x8x57</strong>, <strong>2k3X8X57</strong>, and <strong>00virtual</strong>.</p>
<p>Those three passwords were used by one or all of Wazawaka&#8217;s email addresses on the crime forums over the years, including <strong>wazawaka@yandex.ru</strong>, <strong>mixseo@mail.ru</strong>, <strong>mixseo@yandex.ru</strong>, <strong>mixfb@yandex.ru</strong>.</p>
<p>That last email address was used almost a decade ago to register a <strong>Vkontakte</strong> (Russian version of Facebook) account under the name <strong>Mikhail &#8220;Mix&#8221; Matveev</strong>. The phone number tied to that Vkontakte account &#8212; <strong>7617467845 &#8212; </strong>was assigned by the Russian telephony provider <strong>MegaFon</strong> to a resident in <strong>Khakassia</strong>, situated in the southwestern part of Eastern Siberia.</p>
<p><a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> [an advertiser on this site] reports mixfb@yandex.ru was used to register three domains between 2008 and 2010: <strong>ddosis.ru</strong>, <strong>best-stalker.com</strong>, and <strong>cs-arena.org</strong>. That last domain was originally registered in 2009 to a <strong>Mikhail P. Matveyev</strong>, in <a href="https://en.wikipedia.org/wiki/Abakan" target="_blank" rel="noopener">Abakan, Khakassia</a>.</p>
<p>Mikhail Matveev is not the most unusual name in Russia, but other clues help narrow things down quite a bit. For example, early in his postings to Exploit, Wazawaka can be seen telling members that he can be contacted via the ICQ instant message account <strong>902228</strong>.</p>
<p>An Internet search for Wazawaka&#8217;s ICQ number brings up a 2009 account for a Wazawaka on a now defunct discussion forum about <strong>Kopyovo-a</strong>, a town of roughly 4,400 souls in the Russian republic of Khakassia:</p>
<p><img loading="lazy" class="aligncenter wp-image-58052" src="media/b06f87aa.waza.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza.png" alt="" width="759" height="608" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza.png 886w, https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-768x616.png 768w" sizes="(max-width: 759px) 100vw, 759px" /></p>
<h2>MIKHAIL&#8217;S MIX</h2>
<p>Also around 2009, someone using the nickname Wazawaka and the 902228 ICQ address started posting to Russian social media networks trying to convince locals to frequent the website &#8220;<strong>fureha.ru</strong>,&#8221; which was billed as another website catering to residents of Khakassia.</p>
<p>According to the Russian domain watcher <strong>1stat.ru</strong>, fureha.ru was registered in January 2009 to the email address <strong>mix@devilart.net</strong> and the phone number <strong>+79617467845</strong>, which is the same number tied to the <strong>Mikhail &#8220;Mix&#8221; Matveev</strong> Vkontakte account.</p>
<p>DomainTools.com says the mix@devilart.net address was used to register two domains: one called badamania[.]ru, and a defunct porn site called <strong>tvporka[.]ru</strong>. The phone number tied to that porn site registration back in 2010 was <b>79235810401</b>, also issued by MegaFon in Khakassia.</p>
<p>A search in <strong>Skype</strong> for that number shows that it was associated more than a decade ago with the username &#8220;matveevatanya1.&#8221; It was registered to a now 29-year-old <strong>Tatayana Matveeva Deryabina, </strong>whose Vkontakte profile says she currently resides in <a href="https://www.google.com/maps/place/Krasnoyarsk,+Krasnoyarsk+Krai,+Russia/@56.0266497,92.7253094,11z/data=!3m1!4b1!4m13!1m7!3m6!1s0x5ce34ef434f40753:0x28d30847f549720e!2sBratsk,+Irkutsk+Oblast,+Russia!3b1!8m2!3d56.2928363!4d101.7121217!3m4!1s0x5cd7afc9a1ff37e3:0xd597e1468fd647ff!8m2!3d56.0152725!4d92.8935242" target="_blank" rel="noopener">Krasnoyarsk</a>, the largest city that is closest to Abakan and Abaza.</p>
<p>It seems likely that Tatayana is a relative of Mikhail Matveev, perhaps even his sister. Neither responded to requests for comment. In 2009, a Mikhail Matveev from Abaza, Khakassia registered the username Wazawaka on <strong>weblancer.net</strong>, a freelance job exchange for Russian IT professionals. The Weblancer account says Wazawaka is currently 33 years old.</p>
<p><img loading="lazy" class="aligncenter wp-image-58053" src="media/51ff3f08.waza-mikhail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail.png" alt="" width="756" height="346" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail.png 1044w, https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail-768x352.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail-782x358.png 782w" sizes="(max-width: 756px) 100vw, 756px" /></p>
<p>In March 2019, Wazawaka explained a lengthy absence on Exploit by saying he&#8217;d fathered a child. &#8220;I will answer everyone in a week or two,&#8221; the crime actor wrote. &#8220;Became a dad &#8212; went on vacation for a couple of weeks.&#8221;</p>
<p>One of the many email addresses Wazawaka used was <strong>devdelphi@yandex.ru</strong>, which is tied to a more recent but since-deleted Vkontakte account for a Mikhail Matveev and used the password 2k3X8X57. As per usual, I put together a mind map showing the connections referenced in this story:</p>
<div id="attachment_58059" style="width: 773px" class="wp-caption aligncenter"><a href="media/57e3dffc.wazawaka-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58059" loading="lazy" class="wp-image-58059" src="media/57e3dffc.wazawaka-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm.png" alt="" width="763" height="444" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm.png 1495w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm-768x447.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm-782x455.png 782w" sizes="(max-width: 763px) 100vw, 763px" /></a><p id="caption-attachment-58059" class="wp-caption-text">A rough mind map of the connections mentioned in this story.</p></div>
<p>Analysts with cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> say Wazawaka&#8217;s postings on various Russian crime forums show he is proficient in many specializations, including botnet operations, keylogger malware, spam botnets, credential harvesting, Google Analytics manipulation, selling databases for spam operations, and launching DDoS attacks.</p>
<p>Flashpoint says it is likely Wazawaka/Mix/M1x has shared cybercriminal identities and accounts with multiple other forum members, most of whom appear to have been partners in his DDoS-for-hire business a decade ago. For example, Flashpoint points to an <strong>Antichat</strong> forum thread from 2009 where members said M1x worked on his DDoS service with a hacker by the nickname &#8220;Vedd,&#8221; who was reputedly also a resident of Abakan.</p>
<h2>STAY  TRUE, &amp; MOTHER RUSSIA WILL HELP YOU</h2>
<p>All of this is academic, of course, provided Mr. Wazawaka chooses to a) never leave Russia and b) <a href="https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/" target="_blank" rel="noopener">avoid cybercrime activities that target Russian citizens</a>. In a January 2021 thread on Exploit regarding <a href="https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware/" target="_blank" rel="noopener">the arrest of an affiliate for the NetWalker ransomware program</a> and its subsequent demise, Wazawaka seems already resigned those limitations.</p>
<p>&#8220;Don&#8217;t shit where you live, travel local, and don&#8217;t go abroad,&#8221; Wazawaka said of his own personal mantra.</p>
<p>Which might explain why Wazawaka is so lackadaisical about <a href="https://krebsonsecurity.com/2021/05/the-wages-of-password-re-use-your-money-or-your-life/" target="_blank" rel="noopener">hiding and protecting his cybercriminal identities</a>: Incredibly, Wazawaka&#8217;s alter ego on the forum XSS &#8212; Uhodiransomware &#8212; <em>still uses the same password on the forum that he used for his Vkontakte account 10 years ago</em>. Lucky for him, XSS also demands a one-time code from his mobile authentication app.</p>
<div id="attachment_58093" style="width: 774px" class="wp-caption aligncenter"><a href="media/64660a8c.wazawaka2fa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58093" loading="lazy" class="wp-image-58093" src="media/64660a8c.wazawaka2fa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa.png" alt="" width="764" height="367" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa.png 1311w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa-768x369.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa-782x376.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></a><p id="caption-attachment-58093" class="wp-caption-text">The second step of logging into Wazawaka&#8217;s account on XSS (Uhodiransomwar).</p></div>
<p>Wazawaka said NetWalker&#8217;s closure was the result of its administrator (a.k.a. &#8220;Bugatti&#8221;) getting greedy, and then he proceeds to preach about the need to periodically re-brand one&#8217;s cybercriminal identity.</p>
<p>&#8220;I&#8217;ve had some business with Bugatti,&#8221; Wazawaka said. &#8220;The guy got too rich and began recruiting Americans as affiliate partners. What happened now is the result. That&#8217;s okay, though. I wish Bugatti to do some rebranding and start from the beginning <img src="media/7d7d5e26.1f642.png" data-original-source="https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /> As for the servers that were seized, they should&#8217;ve hosted their admin panels in Russia to avoid getting their servers seized by INTERPOL, the FBI, or whatever.&#8221;</p>
<p>&#8220;Mother Russia will help you,&#8221; Wazawaka concluded. &#8220;Love your country, and you will always get away with everything.&#8221;</p>
<p>If you liked this post, you may also enjoy <a href="https://krebsonsecurity.com/2021/12/who-is-the-network-access-broker-babam/" target="_blank" rel="noopener">Who Is the Network Access Broker &#8220;Babam&#8221;?</a></p>


feed_id: https://krebsonsecurity.com/?p=58116
title: At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates
uri: At-Request-of-U-S-Russia-Rounds-Up-14-REvil-Ransomware-Affiliates
url:
https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/

content:
<p>The Russian government said today it arrested 14 people accused of working for &#8220;<strong>REvil</strong>,&#8221; a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian <strong>Federal Security Service</strong> (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin&#8217;s decision to station 100,000 troops along the nation&#8217;s border with Ukraine.</p>
<div id="attachment_55828" style="width: 778px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55828" loading="lazy" class=" wp-image-55828" src="media/d0fa12ba.fsbhq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq.png" alt="" width="768" height="504" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq.png 1570w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-768x504.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-1536x1008.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-782x513.png 782w" sizes="(max-width: 768px) 100vw, 768px" /><p id="caption-attachment-55828" class="wp-caption-text">The FSB headquarters at Lubyanka Square, Moscow. Image: Wikipedia.</p></div>
<p>The FSB <a href="http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html" target="_blank" rel="noopener">said</a> it arrested 14 REvil ransomware members, and searched more than two dozen addresses in Moscow, St. Petersburg, Leningrad and Lipetsk. As part of the raids, the FSB seized more than $600,000 US dollars, 426 million rubles (~$USD 5.5 million), 500,000 euros, and 20 &#8220;premium cars&#8221; purchased with funds obtained from cybercrime.</p>
<p>&#8220;The search activities were based on the appeal of the US authorities, who reported on the leader of the criminal community and his involvement in encroaching on the information resources of foreign high-tech companies by introducing malicious software, encrypting information and extorting money for its decryption,&#8221; the FSB said. &#8220;Representatives of the US competent authorities have been informed about the results of the operation.&#8221;</p>
<p>The FSB did not release the names of any of the individuals arrested, although a report from the Russian news agency <strong>TASS</strong> <a href="https://tass.ru/proisshestviya/13431845" target="_blank" rel="noopener">mentions two defendants</a>: <strong>Roman Gennadyevich Muromsky</strong>, and <strong>Andrey Sergeevich Bessonov</strong>. Russian media outlet <strong>RIA Novosti</strong> released video footage from some of the raids:</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/Rj4f-8ayq-Q" width="660" height="415" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>REvil is widely thought to be a reincarnation of <a href="https://krebsonsecurity.com/?s=gandcrab" target="_blank" rel="noopener">GandCrab</a>, a Russian-language ransomware affiliate program that bragged of stealing more than $2 billion when it closed up shop in the summer of 2019. For roughly the next two years, REvil&#8217;s &#8220;Happy Blog&#8221; would churn out press releases naming and shaming dozens of new victims each week. A February 2021 analysis from researchers at IBM found the REvil gang <a href="https://www.ibm.com/security/data-breach/threat-intelligence" target="_blank" rel="noopener">earned more than $120 million in 2020 alone</a>.</p>
<p>But all that changed last summer, when REvil associates working with another ransomware group &#8212; <strong>DarkSide</strong> &#8212; attacked <strong>Colonial Pipeline</strong>, <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">causing fuel shortages and price spikes across the United States</a>. Just months later, a multi-country law enforcement operation allowed investigators <a href="https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/" target="_blank" rel="noopener">to hack into the REvil gang&#8217;s operations and force the group offline</a>.</p>
<p>In November 2021, <strong>Europol</strong> <a href="https://www.europol.europa.eu/media-press/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged" target="_blank" rel="noopener">announced</a> it arrested seven REvil affliates who collectively made more than $230 million worth of ransom demands since 2019. At the same time, U.S. authorities <a href="https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/" target="_blank" rel="noopener">unsealed two indictments against a pair of accused REvil cybercriminals</a>, which referred to the men as &#8220;REvil Affiliate #22&#8221; and &#8220;REvil Affiliate #23.&#8221;</p>
<p>It is clear that U.S. authorities have known for some time the real names of REvil&#8217;s top captains and moneymakers. Last fall, President Biden told Putin that <a href="https://www.cnbc.com/2021/07/09/ransomware-biden-presses-putin-to-disrupt-cybercriminals-in-russia.html" target="_blank" rel="noopener">he expects Russia to act</a> when the United States shares information on specific Russians involved in ransomware activity.</p>
<p>So why now? Russia has amassed approximately 100,000 troops along its southern border with Ukraine, and diplomatic efforts to defuse the situation have reportedly broken down. <strong>The Washington Post</strong> and other media outlets today <a href="https://www.washingtonpost.com/national-security/russia-ukraine-invasion-sabotage-operations/2022/01/14/769314a2-754f-11ec-8ec6-9d61f7afbe17_story.html" target="_blank" rel="noopener">report</a> that the Biden administration has accused Moscow of sending saboteurs into Eastern Ukraine to stage an incident that could give Putin a pretext for ordering an invasion.</p>
<p>&#8220;The most interesting thing about these arrests is the timing,&#8221; said <strong>Kevin Breen</strong>, director of threat research at <a href="https://www.immersivelabs.com" target="_blank" rel="noopener">Immersive Labs</a>. &#8220;For years, Russian Government policy on cybercriminals has been less than proactive to say the least. With Russia and the US currently at the diplomatic table, these arrests are likely part of a far wider, multi-layered, political negotiation.&#8221;</p>
<p>President Biden has warned that Russia can expect severe sanctions should it choose to invade Ukraine. But Putin in turn has said such sanctions could cause a complete break in diplomatic relations between the two countries.</p>
<p><strong>Dmitri Alperovitch</strong>, co-founder of and former chief technology officer for the security firm <a href="https://www.crowdstrike.com" target="_blank" rel="noopener">CrowdStrike</a>, called the REvil arrests in Russia &#8220;ransomware diplomacy.&#8221;</p>
<p><span class="pullquote pqright">&#8220;This is Russian ransomware diplomacy,&#8221; Alperovitch said on Twitter.</span> &#8220;It is a signal to the United States &#8212; if you don&#8217;t enact severe sanctions against us for invasion of Ukraine, we will continue to cooperate with you on ransomware investigations.&#8221;<span id="more-58116"></span></p>
<p>The REvil arrests were announced as many government websites in Ukraine were <a href="https://www.nytimes.com/2022/01/14/world/europe/hackers-ukraine-government-sites.html" target="_blank" rel="noopener">defaced by hackers</a> with an ominous message warning Ukrainians that their personal data was being uploaded to the Internet. &#8220;Be afraid and expect the worst,&#8221; the message warned.</p>
<p>Experts say there is good reason for Ukraine to be afraid. Ukraine has long been used as the testing grounds for Russian offensive hacking capabilities. State-backed Russian hackers have been blamed for the <a href="https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/" target="_blank" rel="noopener">Dec. 23, 2015 cyberattack on Ukraine&#8217;s power grid</a> that left 230,000 customers shivering in the dark.</p>
<div id="attachment_58124" style="width: 822px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58124" loading="lazy" class="size-full wp-image-58124" src="media/e36943d4.uadeface.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface.jpeg" alt="" width="812" height="821" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface.jpeg 812w, https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface-768x777.jpeg 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface-782x791.jpeg 782w" sizes="(max-width: 812px) 100vw, 812px" /><p id="caption-attachment-58124" class="wp-caption-text">The warning left behind on Ukrainian government websites that were defaced in the last 24 hours. The same statement is written in Ukrainian, Russian and Polish.</p></div>
<p>Russia also has been suspected of releasing <a href="https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/" target="_blank" rel="noopener">NotPetya</a>, a large-scale cyberattack initially aimed at Ukrainian businesses that ended up creating an extremely disruptive and expensive global malware outbreak.</p>
<p>Although there has been no clear attribution of these latest attacks to Russia, there is reason to suspect Russia&#8217;s hand, said <strong>David Salvo</strong>, deputy director of <a href="https://en.wikipedia.org/wiki/Alliance_for_Securing_Democracy" target="_blank" rel="noopener">The Alliance for Securing Democracy</a>.</p>
<p>&#8220;These are tried and true Russian tactics. Russia used cyber operations and information operations in the run-up to its invasion of Georgia in 2008. It has long waged massive cyberattacks against Ukrainian infrastructure, as well as information operations targeting Ukrainian soldiers and Ukrainian citizens. And it is completely unsurprising that it would use these tactics now when it is clear Moscow is looking for any pretext to invade Ukraine again and cast blame on the West in its typical cynical fashion.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58154
title: IRS Will Soon Require Selfies for Online Access
uri: IRS-Will-Soon-Require-Selfies-for-Online-Access
url: https://krebsonsecurity.com/2022/01/irs-will-soon-require-selfies-for-online-access/
content:
<p>If you created an online account to manage your tax records with the <strong>U.S. Internal Revenue Service</strong> (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through <strong>ID.me</strong>, an online identity verification service that requires applicants to submit copies of bills and identity documents, as well as a live video feed of their faces via a mobile device.</p>
<div id="attachment_58161" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58161" loading="lazy" class=" wp-image-58161" src="media/15092662.irs-idme.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme.png" alt="" width="764" height="563" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme.png 1175w, https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme-768x566.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme-782x576.png 782w" sizes="(max-width: 764px) 100vw, 764px" /><p id="caption-attachment-58161" class="wp-caption-text">The IRS says it will require ID.me for all logins later this summer.</p></div>
<p>McLean, Va.-based ID.me was originally launched in 2010 with the goal of helping e-commerce sites validate the identities of customers who might be <a href="https://shop.id.me/" target="_blank" rel="noopener">eligible for discounts</a> at various retail establishments, such as veterans, teachers, students, nurses and first responders.</p>
<p>These days, ID.me is perhaps better known as the online identity verification service that many states now use to help staunch the loss of billions of dollars in unemployment insurance and pandemic assistance stolen each year by identity thieves. The privately-held company says it has approximately 64 million users, and gains roughly 145,000 new users each day.</p>
<p>Some 27 states already use ID.me to screen for identity thieves applying for benefits in someone else&#8217;s name, and now the IRS is joining them. The service requires applicants to supply a great deal more information than typically requested for online verification schemes, such as scans of their driver’s license or other government-issued ID, copies of utility or insurance bills, and details about their mobile phone service.</p>
<p>When an applicant doesn’t have one or more of the above — or if something about their application triggers potential fraud flags — ID.me may require a recorded, live video chat with the person applying for benefits.</p>
<p>Since my credentials at the IRS will soon no longer work, I opted to create an ID.me account and share the experience here. <em>An important preface to this walk-through is that verifying one&#8217;s self with Id.me requires one to be able to take a live, video selfie</em> &#8212; either with the camera on a mobile device or a webcam attached to a computer (your webcam must be able to open on the device you&#8217;re using to apply for the ID.me account).<span id="more-58154"></span></p>
<p>Also, successfully verifying your identity with ID.me may require a significant investment of time, and quite a bit of patience. For example, stepping away from one part of the many-step application process for a little more than five minutes necessitated another login, and then the re-submission of documents I&#8217;d previously uploaded.</p>
<p><img loading="lazy" class="alignright wp-image-58164" src="media/cec36ad5.idm-2fa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/idm-2fa.png" alt="" width="348" height="684" />After entering an email address and picking a password, you are prompted to confirm your email address by clicking a link sent to that address. After confirmation, ID.me prompts users to choose a multi-factor authentication (MFA) option.</p>
<p>The MFA options range from a six-digit code sent via text message or phone call to code generator apps and FIDO Security Keys. ID.me even suggests using its own branded one-time code generating app, which can &#8220;push&#8221; a prompt to your mobile device for you to approve whenever you log in. I went with and would encourage others to use the strongest MFA option &#8212; a physical Security Key. For more on the benefits of using a Security Key for MFA, see <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">this post</a>.</p>
<p>When the MFA option is verified, the system produces a one-time backup code and suggests you save that in a safe place in case your chosen MFA option is unavailable the next time you try to use a service that requires ID.me.</p>
<p>Next, applicants are asked to upload images of their driver&#8217;s license, state-issued ID, or passport &#8212; either via a saved file or by scanning them with a webcam or mobile device.</p>
<p>If your documents get accepted, ID.me will then prompt you to take a live selfie with your mobile device or webcam. That took several attempts. When my computer&#8217;s camera produced an acceptable result, ID.me said it was comparing the output to the images on my driver&#8217;s license scans.</p>
<p>After this, ID.me requires the verification of your phone number, which means they will ask your mobile or landline provider to validate you are indeed an existing, paying customer who can be reached at that number. ID.me says it currently does not accept phone numbers tied to voice-over-IP services like Google Voice and Skype.</p>
<p>My application got stuck interminably at the &#8220;Confirming Your Phone&#8221; stage, which is somewhere near the middle of the entire verification process.</p>
<p>An email to ID.me&#8217;s support people generated a message with a link to complete the verification process via a live video chat. Unfortunately, clicking that link brought up prompts to re-upload all of the information I&#8217;d already supplied, and then some.</p>
<div id="attachment_58170" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58170" loading="lazy" class=" wp-image-58170" src="media/6c8c324f.idm-choosetoadd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/idm-choosetoadd.png" alt="" width="751" height="873" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/idm-choosetoadd.png 800w, https://krebsonsecurity.com/wp-content/uploads/2022/01/idm-choosetoadd-768x893.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/idm-choosetoadd-782x909.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-58170" class="wp-caption-text">Some of the primary and secondary documents requested by ID.me.</p></div>
<p>For example, completing the process requires submitting at least two secondary identification documents, such as as a Social Security card, a birth certificate, health insurance card, W-2 form, electric bill, or financial institution statement.</p>
<p>After re-uploading all of this information, ID.me&#8217;s system prompted me to &#8220;Please stay on this screen to join video call.&#8221; However, the estimated wait time when that message first popped up said &#8220;3 hours and 27 minutes.&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-58171" src="media/9a756823.idme-waittime.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/idme-waittime.png" alt="" width="760" height="884" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/idme-waittime.png 800w, https://krebsonsecurity.com/wp-content/uploads/2022/01/idme-waittime-768x893.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/idme-waittime-782x909.png 782w" sizes="(max-width: 760px) 100vw, 760px" /></p>
<p>I appreciate that ID.me&#8217;s system relies on real human beings seeking to interview applicants in real-time, and that not all of those representatives can be expected to handle all of these immediately. And I get that slowing things down is an important part of defeating identity fraudsters who are seeking to exploit automated identity verification systems that largely rely on static data about consumers.</p>
<p>That said, I started this &#8220;Meet an agent&#8221; process at around 9:30 in the evening, and I wasn&#8217;t particularly looking forward to staying up until midnight to complete it. But not long after the message about waiting 3 hours came up, I got a phone call from an ID.me technician who was CC&#8217;d on my original email to ID.me&#8217;s founder. Against my repeated protests that I wanted to wait my turn like everyone else, he said he would handle the process himself.</p>
<p>Sure enough, a minute later I was connected with the ID.me support person, who finished the verification in a video phone call. That took about one minute. But for anyone who fails the automated signup, count on spending several hours getting verified.</p>
<p>When my application was finally approved, I headed back to irs.gov and proceeded to log in with my new ID.me account. After granting the IRS access to the personal data I&#8217;d shared with ID.me, I was looking at my most recent tax data on the IRS website.</p>
<p><img loading="lazy" class="aligncenter wp-image-58173" src="media/edad8c8c.authorizeirs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/authorizeirs.png" alt="" width="757" height="871" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/authorizeirs.png 800w, https://krebsonsecurity.com/wp-content/uploads/2022/01/authorizeirs-768x883.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/authorizeirs-782x899.png 782w" sizes="(max-width: 757px) 100vw, 757px" /></p>
<p>I was somewhat concerned that my ID verification might fail because I have <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">a security freeze on my credit file with the three major consumer credit bureaus</a>. But at no time during my application process did ID.me even mention the need to lift or thaw that security freeze to complete the authentication process.</p>
<p>The IRS previously relied upon <strong>Equifax</strong> for its identity proofing process, and even then anyone with frozen credit files had to lift the freeze to make it through the IRS&#8217;s legacy authentication system. For several years, the result of that reliance was that ID thieves <a href="https://krebsonsecurity.com/?s=get+transcript+irs" target="_blank" rel="noopener">massively abused the IRS&#8217;s own website</a> to impersonate taxpayers, view their confidential tax records, and ultimately obtain fraudulent tax refunds in their names.</p>
<p>The IRS canceled its &#8220;taxpayer identity&#8221; contract with Equifax in October 2017, after the credit bureau disclosed that a failure to patch <a href="https://krebsonsecurity.com/2017/09/equifax-hackers-stole-200k-credit-card-accounts-in-one-fell-swoop/" target="_blank" rel="noopener">a four-month-old zero-day security flaw</a> led to <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank" rel="noopener">the theft of Social Security numbers and personal and financial information on 148 million Americans</a>.</p>
<p>Perhaps in light of that 2017 megabreach, many readers will be rightfully concerned about being forced to provide so much sensitive information to a relatively unknown private company. KrebsOnSecurity spoke with ID.me founder and <strong>CEO Blake Hall</strong> in last year&#8217;s story, <a href="https://krebsonsecurity.com/2021/02/how-100m-in-jobless-claims-went-to-inmates/" target="_blank" rel="noopener">How $100 Million in Jobless Claims Went to Inmates</a>. I asked Hall what ID.me does to secure all this sensitive information it collects, which would no doubt serve as an enticing target for hackers and identity thieves.</p>
<p>Hall said ID.me is certified against the NIST 800-63-3 digital identity guidelines, employs multiple layers of security, and fully segregates static consumer data tied to a validated identity from a token used to represent that identity.</p>
<p>“We take a defense-in-depth approach, with partitioned networks, and use very sophisticated encryption scheme so that when and if there is a breach, this stuff is firewalled,” Hall said. “You’d have to compromise the tokens at scale and not just the database. We encrypt all that stuff down to the file level with keys that rotate and expire every 24 hours. And once we’ve verified you we don’t need that data about you on an ongoing basis.”</p>
<p>ID.me&#8217;s privacy policy states that if you sign up for ID.me &#8220;in connection with legal identity verification or a government agency we will not use your verification information for any type of marketing or promotional purposes.&#8221;</p>
<p>Signing up at ID.me requires users to approve a <a href="https://krebsonsecurity.com/wp-content/uploads/2022/01/idme-biometricdatapolicy.txt" target="_blank" rel="noopener">biometric data policy</a> that states the company will not sell, lease, or trade your biometric data to any third parties or seek to derive any profit from that information. ID.me says users can delete their biometric data at any time, but there was no apparent option to do so when I logged straight into my new account at ID.me.</p>
<p>When I asked the support technician who conducted the video interview to remove my biometric data, he sent me <a href="https://help.id.me/hc/en-us/articles/203532014-How-do-I-close-delete-my-ID-me-account-" target="_blank" rel="noopener">a link</a> to a process for deleting one&#8217;s ID.me account. So, it seems that removing one&#8217;s data from ID.me post-verification equals deleting one&#8217;s account, and potentially having to re-register at some point in the future.</p>
<p>Over the years, I&#8217;ve tried to stress the importance of creating accounts online tied to your various identity, financial and communications services before identity thieves do it for you. But all of those places where you should &#8220;<a href="https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/" target="_blank" rel="noopener">Plant Your Flag</a>&#8221; conduct identity verification in an automated fashion, using entirely static data points about consumers that have been breached many times over (SSNs, DoBs, etc).</p>
<p>Love it or hate it, ID.me is likely to become one of those places where Americans need to plant their flag and mark their territory, if for no other reason than it will probably be needed at some point to manage your relationship with the federal government and/or your state. And given the potential time investment needed to successfully create an ID.me account, it might be a good idea to do that before you&#8217;re forced to do so at the last minute (such as waiting until the eleventh hour to pay your quarterly or annual estimated taxes).</p>
<p>If you&#8217;ve visited <a href="https://secure.ssa.gov/RIL/SiView.action" target="_blank" rel="noopener">the sign-in page</a> at the <strong>U.S. Social Security Administration</strong> (SSA) lately, you&#8217;ll notice that on or around Sept. 18, 2021 the agency stopped allowing new accounts to be created with only a username and password. Anyone seeking to create an account at the SSA is now steered toward either ID.me or <a href="https://www.login.gov/what-is-login/" target="_blank" rel="noopener">Login.gov</a>, a single sign-on solution for U.S. government websites.</p>
<p><img loading="lazy" class="aligncenter wp-image-58182" src="media/657758a8.ssalogin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/ssalogin.png" alt="" width="761" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/ssalogin.png 937w, https://krebsonsecurity.com/wp-content/uploads/2022/01/ssalogin-768x497.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/ssalogin-782x506.png 782w" sizes="(max-width: 761px) 100vw, 761px" /></p>


feed_id: https://krebsonsecurity.com/?p=58194
title: Crime Shop Sells Hacked Logins to Other Crime Shops
uri: Crime-Shop-Sells-Hacked-Logins-to-Other-Crime-Shops
url: https://krebsonsecurity.com/2022/01/crime-shop-sells-hacked-logins-to-other-crime-shops/
content:
<p>Up for the &#8220;Most Meta Cybercrime Offering&#8221; award this year is <strong>Accountz Club</strong>, a new cybercrime store that sells access to purloined accounts at services built for cybercriminals, including shops peddling stolen payment cards and identities, spamming tools, email and phone bombing services, and those selling authentication cookies for a slew of popular websites.</p>
<p><a href="media/4373d6e0.accountzclub-rd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/accountzclub-rd.png" target="_blank" rel="noopener"><img loading="lazy" class="aligncenter wp-image-58207" src="media/4373d6e0.accountzclub-rd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/accountzclub-rd.png" alt="" width="764" height="500" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/accountzclub-rd.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2022/01/accountzclub-rd-768x503.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/accountzclub-rd-782x512.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></a></p>
<p>Criminals ripping off other crooks is a constant theme in the cybercrime underworld; Accountz Club&#8217;s slogan  &#8212; &#8220;the best autoshop for your favorite shops&#8217; accounts&#8221; &#8212; just normalizes this activity by making logins stolen from users of various cybercrime shops for sale at a fraction of their account balances.</p>
<p>The site says it sells &#8220;cracked&#8221; accounts, or those that used passwords which could be easily guessed or enumerated by automated tools. All of the credentials being sold by Accountz provide access to services that in turn sell access to stolen information or hijacked property, as in the case of &#8220;bot shops&#8221; that resell access to infected computers.</p>
<p>One example is <a href="http://digitalshadows.com/blog-and-research/the-technology-adoption-lifecycle-of-genesis-market/" target="_blank" rel="noopener">Genesis Market</a>, where customers can search for stolen credentials and authentication cookies from a broad range of popular online destinations. Genesis even offers a custom-made web browser where you can load authentication cookies from botted PCs and waltz right into the account without having to enter a username or password or mess with multi-factor authentication.</p>
<p>Accountz is currently selling four different Genesis logins for about 40-50 percent of their unspent balances. Genesis mostly gets its inventory of botted computers and stolen logins from resellers who specialize in deploying infostealer malware via email and booby-trapped websites. Likewise, it appears Accountz also derives much of its stock from a handful of resellers, who presumably are the same ones doing the cybercrime service account cracking.</p>
<div id="attachment_58210" style="width: 766px" class="wp-caption aligncenter"><a href="media/a9ac02a4.genesisshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58210" loading="lazy" class="wp-image-58210" src="media/a9ac02a4.genesisshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png" alt="" width="756" height="495" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop-768x503.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop-782x512.png 782w" sizes="(max-width: 756px) 100vw, 756px" /></a><p id="caption-attachment-58210" class="wp-caption-text">The Genesis bot shop.</p></div>
<p>In essence, Accountz customers are paying for illicit access to cybercrime services that sell access to compromised resources that can be abused for cybercrime. That&#8217;s seriously meta.<span id="more-58194"></span></p>
<p>Accountz says its inventory is low right now but that it expects to offer a great deal more stock in the coming days. I don&#8217;t doubt that&#8217;s true, and it&#8217;s somewhat remarkable that services like this aren&#8217;t more common: From reporting <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank" rel="noopener">my &#8220;Breadcrumbs&#8221; series on prominent cybercrime actors</a>, it&#8217;s clear that a great many cybercriminals will use the same username and password across multiple services online.</p>
<p>What&#8217;s more, relatively few cybercrime shops online offer their users any sort of multi-factor authentication. That&#8217;s probably because so few customers supply their real contact information when they sign up. As a result, it is often far easier for customers to simply create a new account than it is to regain control over a hacked one, or to change a forgotten password. On top of that, most shops have only rudimentary tools for blocking automated login attempts and password cracking activity.</p>
<p>It will be interesting to see whether any of the cybercrime shops most heavily represented in the logins for sale at Accountz start to push back. After all, draining customer account balances and locking out users is likely to increase customer support costs for these shops, lower customer satisfaction, and perhaps even damage their reputations on the crime forums where they peddle their wares.</p>
<p>Oh, the horror.</p>


feed_id: https://krebsonsecurity.com/?p=58202
title: Scary Fraud Ensues When ID Theft & Usury Collide
uri: Scary-Fraud-Ensues-When-ID-Theft-Usury-Collide
url: https://krebsonsecurity.com/2022/01/scary-fraud-ensues-when-id-theft-usury-collide/
content:
<p>What&#8217;s worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One reader&#8217;s nightmare experience spotlights what can happen when ID thieves and hackers start targeting online payday lenders.</p>
<p><img loading="lazy" class="aligncenter wp-image-58249" src="media/8d3ed20b.cliffguy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/cliffguy.png" alt="" width="757" height="564" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/cliffguy.png 830w, https://krebsonsecurity.com/wp-content/uploads/2022/01/cliffguy-768x572.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/cliffguy-782x582.png 782w" sizes="(max-width: 757px) 100vw, 757px" /></p>
<p>The reader who shared this story (and copious documentation to go with it) asked to have his real name omitted to avoid encouraging further attacks against his identity. So we&#8217;ll just call him &#8220;Jim.&#8221; Last May, someone applied for some type of loan in Jim&#8217;s name. The request was likely sent to an online portal that takes the borrower&#8217;s loan application details and shares them with multiple prospective lenders, because Jim said over the next few days he received dozens of emails and calls from lenders wanting to approve him for a loan.</p>
<p>Many of these lenders were eager to give Jim money because they were charging exorbitant 500-900 percent interest rates for their loans. But Jim has long had <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">a security freeze on his credit file with the three major consumer credit reporting bureaus</a>, and none of the lenders seemed willing to proceed without at least a peek at his credit history.</p>
<p>Among the companies that checked to see if Jim still wanted that loan he never applied for last May was <a href="https://www.mountainsummitfinancial.com" target="_blank" rel="noopener">Mountain Summit Financial</a> (MSF), a lending institution owned by a Native American tribe in California called the <a href="https://www.hpultribe-nsn.gov/" target="_blank" rel="noopener">Habematelol Pomo of Upper Lake</a>.</p>
<p>Jim told MSF and others who called or emailed that identity thieves had applied for the funds using his name and information; that he would never take out a payday loan; and would they please remove his information from their database? Jim says MSF assured him it would, and the loan was never issued.</p>
<p>Jim spent months sorting out that mess with MSF and other potential lenders, but after a while the inquiries died down. Then on Nov. 27 &#8212; Thanksgiving Day weekend &#8212; Jim got a series of rapid-fire emails from MSF saying they&#8217;ve received his loan application, that they&#8217;d approved it, and that the funds requested were now available at the bank account specified in his MSF profile.</p>
<p>Curiously, the fraudsters had taken out a loan in Jim&#8217;s name with MSF using his real email address &#8212; the same email address the fraudsters had used to impersonate him to MSF back in May 2021. Although he didn&#8217;t technically have an account with MSF, their authentication system is based on email addresses, so Jim requested that a password reset link be sent to his email address. That worked, and once inside the account Jim could see more about the loan details:</p>
<div id="attachment_58245" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58245" loading="lazy" class="size-full wp-image-58245" src="media/2dc6f152.msfloanagreement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/msfloanagreement.png" alt="" width="761" height="715" /><p id="caption-attachment-58245" class="wp-caption-text">The terms of the unauthorized loan in Jim&#8217;s name from MSF.</p></div>
<p>Take a look at that 546.56 percent interest rate and finance charges listed in this $1,000 loan. If you pay this loan off in a year at the suggested bi-weekly payment amounts, you will have paid $3,903.57 for that $1,000.</p>
<p>Jim contacted MSF as soon as they opened the following week and found out the money had already been dispersed to a Bank of America account Jim didn&#8217;t recognize. MSF had Jim fill out an affidavit claiming the loan was the result of identity theft, which necessitated filing a report with the local police and a number of other steps. Jim said numerous calls to Bank of America&#8217;s fraud team went nowhere because they refused to discuss an account that was not in his name.</p>
<p>Jim said MSF ultimately agreed that the loan wasn&#8217;t legitimate, but they couldn&#8217;t or wouldn&#8217;t tell him how his information got pushed through to a loan &#8212; even though MSF was never able to pull his credit file.</p>
<p>Then in mid-January, Jim heard from MSF via snail mail that they&#8217;d discovered a data breach.</p>
<p>&#8220;We believe the outsider may have had an opportunity to access the accounts of certain customers, including your account, at which point they would be able to view personal information pertaining to that customer and potentially obtain an unauthorized loan using the customer&#8217;s credentials,&#8221; MSF said.</p>
<p>MSF said the personal information involved in this incident may have included name, date of birth, government-issued identification numbers (e.g., SSN or DLN), bank account number and routing number, home address, email address, phone number and other general loan information.</p>
<div id="attachment_58230" style="width: 804px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58230" loading="lazy" class="size-full wp-image-58230" src="media/42760b07.msfletter-red5.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/msfletter-red5.png" alt="" width="794" height="696" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/msfletter-red5.png 794w, https://krebsonsecurity.com/wp-content/uploads/2022/01/msfletter-red5-768x673.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/msfletter-red5-782x685.png 782w" sizes="(max-width: 794px) 100vw, 794px" /><p id="caption-attachment-58230" class="wp-caption-text">A portion of the Jan. 14, 2022 breach notification letter from tribal lender Mountain Summit Financial.</p></div>
<p>Nevermind that his information was only in MSF&#8217;s system because of an earlier attempt by ID thieves: The intruders were able to update his existing (never-deleted) record with new banking information and then push the application through MSF&#8217;s systems.</p>
<p>&#8220;MSF was the target of a suspected third-party attack,&#8221; the company said, noting that it was working with the FBI, the California Sheriff&#8217;s Office, and the Tribal Commission for Lake County, Calif.  &#8220;Ultimately, MSF confirmed that these trends were part of an attack that originated outside of the company.&#8221;</p>
<p>MSF has not responded to questions about the aforementioned third party or parties that may be involved. But it is possible that other tribal lenders could have been affected: Jim said that not long after the phony MSF payday loan was pushed through, he received at least three inquiries in rapid succession from other lenders who were all of a sudden interested in offering him a loan.</p>
<p>In a statement sent to KrebsOnSecurity, MSF said it was &#8220;the victim of a malicious attack that originated outside of the company, by unknown perpetrators.&#8221;</p>
<p>&#8220;As soon as the issue was uncovered, the company initiated cybersecurity incident response measures to protect and secure its information; and notified law enforcement and regulators,&#8221; MSF wrote. &#8220;Additionally, the company has notified individuals whose personal identifiable information may have been impacted by this crime and is actively working with law enforcement in its investigation. As this is an ongoing criminal investigation, we can make no additional comment at this time.&#8221;</p>
<p>According to the <strong>Native American Financial Services Association</strong> (NAFSA), a trade group in Washington, D.C. representing tribal lenders, the short-term installment loan products offered by NAFSA members are not payday loans but rather &#8220;<a href="https://nativefinance.org/truth-tribal-lending/" target="_blank" rel="noopener">installment loans</a>&#8221; &#8212; which are amortized, have a definite loan term, and require payments that go toward not just interest, but that also pay down the loan principal.</p>
<p>NAFSA did not respond to multiple requests for comment.</p>
<p>Nearly all U.S. states have usury laws that limit the amount of interest a company can charge on a loan, but those limits traditionally haven&#8217;t applied to tribal lenders.<span id="more-58202"></span></p>
<p><strong>Leslie Bailey</strong> is a staff attorney at <a href="https://www.publicjustice.net" target="_blank" rel="noopener">Public Justice</a>, a nonprofit legal advocacy organization in Oakland, Calif. Bailey says an increasing number of online payday lenders have sought affiliations with Native American tribes in an effort to take advantage of the tribes’ special legal status as sovereign nations.</p>
<p>&#8220;The reason is clear: Genuine tribal businesses are entitled to &#8216;tribal immunity,&#8217; meaning they can’t be sued,&#8221; Bailey wrote in <a href="https://www.publicjustice.net/tribal-immunity-may-no-longer-get-jail-free-card-payday-lenders/#:~:text=The%20reason%20is%20clear%3A%20genuine,for%20breaking%20state%20usury%20laws." target="_blank" rel="noopener">a blog post</a>. &#8220;If a payday lender can shield itself with tribal immunity, it can keep making loans with illegally-high interest rates without being held accountable for breaking state usury laws.&#8221;</p>
<p>Bailey said in one common type of arrangement, the lender provides the necessary capital, expertise, staff, technology, and corporate structure to run the lending business and keeps most of the profits. In exchange for a small percent of the revenue (usually 1-2%), the tribe agrees to help draw up paperwork designating the tribe as the owner and operator of the lending business.</p>
<p>&#8220;Then, if the lender is sued in court by a state agency or a group of cheated borrowers, the lender relies on this paperwork to claim it is entitled to immunity as if it were itself a tribe,&#8221; Bailey wrote. &#8220;This type of arrangement — sometimes called &#8216;rent-a-tribe&#8217; &#8212; worked well for lenders for a while, because many courts took the corporate documents at face value rather than peering behind the curtain at who’s really getting the money and how the business is actually run. But if recent events are any indication, legal landscape is shifting towards increased accountability and transparency.&#8221;</p>
<p>In 2017, the <strong>Consumer Financial Protection Bureau</strong> <a href="https://www.consumerfinance.gov/enforcement/actions/golden-valley-lending-inc-silver-cloud-financial-inc-mountain-summit-financial-inc-and-majestic-lake-financial-inc/" target="_blank" rel="noopener">sued four tribal online payday lenders</a> in federal court &#8212; including Mountain Summit Financial &#8212; for allegedly deceiving consumers and collecting debt that was not legally owed in many states. All four companies are owned by the Habematolel Pomo of Upper Lake.</p>
<p>The CFPB later dropped that inquiry. But <a href="media/af245973.54-amended-complaint.pdf" data-original-source="https://turtletalk.files.wordpress.com/2020/01/54-amended-complaint.pdf" target="_blank" rel="noopener">a class action lawsuit</a> (PDF) against those same four lenders is proceeding in Virginia, where a group of plaintiffs have alleged the defendants violated the Racketeer Influenced and Corrupt Organizations Act (RICO) and Virginia usury laws by charging interest rates between 544 and 920 percent.</p>
<p>According to <a href="https://www.lexology.com/library/detail.aspx?g=8455a945-6fb5-4e80-abc5-88e502c7f56a" target="_blank" rel="noopener">Buckley LLP</a>, a financial services law firm based in Washington, D.C., a district court dismissed the RICO claims but denied the defense&#8217;s motion to compel arbitration and dismiss the case, ruling that the arbitration provision was unenforceable as a prospective waiver of the borrowers’ federal rights and that the defendants could not claim tribal sovereign immunity. The district court also “held the loan agreements’ choice of tribal law unenforceable as a violation of Virginia’s strong public policy against unregulated lending of usurious loans.&#8221;</p>
<p>Buckley notes that on Nov. 16, 2021, the U.S. Court of Appeals for the Fourth Circuit upheld the district court ruling, concluding that the arbitration clauses in the loan agreements &#8220;impermissibly force borrowers to waive their federal substantive rights under federal consumer protection laws, and contained an unenforceable tribal choice-of-law provision because Virginia law caps general interest rates at 12 percent.&#8221;</p>
<p>Jim said he learned of the Thanksgiving weekend MSF loan only because the hackers apparently figured it was easier to push through loans using existing MSF customer account information than it was to alter anything in the records other than the bank account for receiving the funds.</p>
<p>But had the hackers changed the email address, Jim might have first found out about the loan when the collection agencies came calling. And by then, his exorbitant loan would be in default and racking up some wicked late charges.</p>
<p>Jim says he&#8217;s still hopping mad at MSF, and these days he&#8217;s just waiting for the other shoe to drop.</p>
<p>&#8220;They issued this loan in my name without verification and without even checking my credit at all, even though they were already on notice that they shouldn&#8217;t have been dealing with me from the May incident,&#8221; Jim said. &#8220;I still feel like I&#8217;m going to get that call at some point from a collection agency asking why I haven&#8217;t been making payments on some installment loan I never asked for.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58279
title: Who Wrote the ALPHV/BlackCat Ransomware Strain?
uri: Who-Wrote-the-ALPHV-BlackCat-Ransomware-Strain
url: https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/
content:
<p>In December 2021, researchers discovered a new ransomware-as-a-service named <strong>ALPHV </strong>(a.k.a. &#8220;<strong>BlackCat</strong>&#8220;), considered to be the first professional cybercrime group to create and use a ransomware strain written in the <strong>Rust</strong> programming language. In this post, we&#8217;ll explore some of the clues left behind by a developer who was reputedly hired to code the ransomware variant.</p>
<div id="attachment_58289" style="width: 740px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58289" loading="lazy" class="size-full wp-image-58289" src="media/98b9091f.blackcat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/blackcat.png" alt="" width="730" height="346" /><p id="caption-attachment-58289" class="wp-caption-text">Image: Varonis.</p></div>
<p>According to an analysis <a href="https://www.varonis.com/blog/alphv-blackcat-ransomware" target="_blank" rel="noopener">released this week by Varonis</a>, ALPHV is actively recruiting operators from several ransomware organizations &#8212; including <a href="https://krebsonsecurity.com/?s=REvil" target="_blank" rel="noopener">REvil</a>, <a href="https://krebsonsecurity.com/?s=blackmatter" target="_blank" rel="noopener">BlackMatter</a> and <a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener">DarkSide</a> &#8212; and is offering affiliates up to 90 percent of any ransom paid by a victim organization.</p>
<p>&#8220;The group’s leak site, active since early December 2021, has named over twenty victim organizations as of late January 2022, though the total number of victims, including those that have paid a ransom to avoid exposure, is likely greater,&#8221; Varonis&#8217;s <strong>Jason Hill</strong> wrote.</p>
<p>One concern about more malware shifting to <a href="https://en.wikipedia.org/wiki/Rust_(programming_language)" target="_blank" rel="noopener">Rust</a> is that it is considered a much more secure programming language compared to C and C++, writes <strong>Catalin Cimpanu</strong> for <a href="https://therecord.media/alphv-blackcat-is-the-first-professional-ransomware-gang-to-use-rust/" target="_blank" rel="noopener">The Record</a>. The upshot? Security defenders are constantly looking for coding weaknesses in many ransomware strains, and if more start moving to Rust it could become more difficult to find those soft spots.</p>
<p>Researchers at <strong>Recorded Future</strong> say they believe the ALPHV/BlackCat author was previously involved with the infamous REvil ransomware cartel in some capacity. Earlier this month the Russian government announced that at the United States&#8217; request it <a href="https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/" target="_blank" rel="noopener">arrested 14 individuals in Russia thought to be REvil operators</a>.</p>
<p>Still, REvil rolls on despite these actions, according to <strong>Paul Roberts</strong> at <a href="https://blog.reversinglabs.com/blog/after-russian-arrests-revil-rolls-on?utm_campaign=FY22-Q1-CO-Blog-After%20Russian%20Arrests%20REvil%20Rolls%20On&amp;utm_source=earnedmedia&amp;utm_medium=pr&amp;utm_content=blog" target="_blank" rel="noopener">ReversingLabs</a>. &#8220;The recent arrests have NOT led to a noticeable change in detections of REvil malicious files,&#8221; Roberts wrote. &#8220;In fact, detections of files and other software modules associated with the REvil ransomware increased modestly in the week following the arrests by Russia’s FSB intelligence service.&#8221;</p>
<p>Meanwhile, the <strong>U.S. State Department </strong>has <a href="https://www.state.gov/reward-offers-for-information-to-bring-sodinokibi-revil-ransomware-variant-co-conspirators-to-justice/" target="_blank" rel="noopener">a standing $10 million reward</a> for information leading to the identification or location of any individuals holding key leadership positions in REvil.</p>
<h2>WHO IS BINRS?</h2>
<p>A confidential source recently had a private conversation with a support representative who fields questions and inquiries on several cybercrime forums on behalf of a large and popular ransomware affiliate program. The affiliate rep confirmed that a coder for ALPHV was known by the handle &#8220;<strong>Binrs</strong>&#8221; on multiple Russian-language forums.</p>
<p>On the cybercrime forum <strong>RAMP</strong>, the user Binrs says they are a Rust developer who&#8217;s been coding for 6 years. &#8220;My stack is Rust, nodejs, php, golang,&#8221; Binrs said in an introductory post, in which they claim to be fluent in English. Binrs then signs the post with their identification number for <a href="https://en.wikipedia.org/wiki/Tox_(protocol)" target="_blank" rel="noopener">ToX</a>, a peer-to-peer instant messaging service.</p>
<p>That same ToX ID was claimed by a user called &#8220;<strong>smiseo</strong>&#8221; on the Russian forum BHF, in which smiseo advertises &#8220;clipper&#8221; malware written in Rust that <a href="https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/" target="_blank" rel="noopener">swaps in the attacker&#8217;s bitcoin address</a> when the victim copies a cryptocurrency address to their computer&#8217;s temporary clipboard.</p>
<p>The nickname &#8220;<strong>YBCat</strong>&#8221; advertised that same ToX ID on Carder[.]uk, where this user claimed ownership over the Telegram account <strong>@CookieDays</strong>, and said they could be hired to do software and bot development &#8220;of any level of complexity.&#8221; YBCat mostly sold &#8220;installs,&#8221; offering paying customers to ability to load malware of their choice on thousands of hacked computers simultaneously.</p>
<p>There is also an active user named Binrs on the Russian crime forum wwh-club[.]co who says they&#8217;re a Rust coder who can be reached at the @CookieDays Telegram account.</p>
<p>On the Russian forum Lolzteam, a member with the username &#8220;<strong>DuckerMan</strong>&#8221; uses the @CookieDays Telegram account in his signature. In one thread, DuckerMan promotes an affiliate program called CookieDays that lets people make money by getting others to install cryptomining programs that are infected with malware. In another thread, DuckerMan is selling a different clipboard hijacking program called Chloe Clipper.</p>
<div id="attachment_58293" style="width: 722px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58293" loading="lazy" class=" wp-image-58293" src="media/06b27714.cookiedays.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/cookiedays.png" alt="" width="712" height="863" /><p id="caption-attachment-58293" class="wp-caption-text">The CookieDays moneymaking program.</p></div>
<p>According to threat intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, the Telegram user DuckerMan employed another alias &#8212; <strong>Sergey Duck</strong>. These accounts were most active in the Telegram channels &#8220;Bank Accounts Selling,&#8221; &#8220;Malware developers community,&#8221; and &#8220;Raidforums,&#8221; a popular English-language cybercrime forum.<span id="more-58279"></span></p>
<h2>I AM DUCKERMAN</h2>
<p>The <strong>GitHub</strong> account for a <a href="https://github.com/DuckerMan" target="_blank" rel="noopener">Sergey DuckerMan</a> lists dozens of code repositories this user has posted online over the years. The majority of these projects were written in Rust, and the rest in PHP, Golang and Nodejs &#8212; the same coding languages specified by Binrs on RAMP. The Sergey DuckerMan GitHub account also says it is associated with the &#8220;DuckerMan&#8221; account on Telegram.</p>
<div id="attachment_58292" style="width: 772px" class="wp-caption aligncenter"><a href="media/11ae11de.DuckerMan.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/DuckerMan.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58292" loading="lazy" class="wp-image-58292" src="media/11ae11de.DuckerMan.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/DuckerMan.png" alt="" width="762" height="523" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/DuckerMan.png 1256w, https://krebsonsecurity.com/wp-content/uploads/2022/01/DuckerMan-768x528.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/DuckerMan-782x537.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/01/DuckerMan-100x70.png 100w" sizes="(max-width: 762px) 100vw, 762px" /></a><p id="caption-attachment-58292" class="wp-caption-text">Sergey DuckerMan&#8217;s GitHub profile.</p></div>
<p>Sergey DuckerMan has left many accolades for other programmers on GitHub &#8212; 460 to be exact. In June 2020, for example, DuckerMan gave a star to <a href="https://github.com/cdong1012/Rust-Ransomware" target="_blank" rel="noopener">a proof-of-concept ransomware strain written in Rust</a>.</p>
<p>Sergey DuckerMan&#8217;s Github profile says their social media account at <strong>Vkontakte</strong> (Russian version of Facebook/Meta) is <strong>vk.com/duckermanit</strong>. That profile is restricted to friends-only, but states that it belongs to a <strong>Sergey Pechnikov</strong> from <a href="https://en.wikipedia.org/wiki/Shuya,_Ivanovo_Oblast" target="_blank" rel="noopener">Shuya, Russia</a>.</p>
<p>A look at the Duckermanit VKontakte profile <a href="https://web.archive.org/web/20191118232152/https://vk.com/duckermanit" target="_blank" rel="noopener">in Archive.org</a> shows that until recently it bore a different name: <strong>Sergey Kryakov</strong>. The current profile image on the Pechnikov account shows a young man standing closely next to a young woman.</p>
<p>KrebsOnSecurity reached out to Pechnikov in transliterated Russian via the instant message feature built into VKontakte.</p>
<p>&#8220;I&#8217;ve heard about ALPHV,&#8221; Pechnikov replied in English. &#8220;It sounds really cool and I&#8217;m glad that Rust becomes more and more popular, even in malware sphere. But I don&#8217;t have any connections with ransomware at all.&#8221;</p>
<p>I began explaining the clues that led to his VK account, and how a key cybercriminal actor in the ransomware space had confirmed that Binrs was a core developer for the ALPHV ransomware.</p>
<p>&#8220;Binrs isn&#8217;t even a programmer,&#8221; Pechnikov interjected. &#8220;He/she can&#8217;t be a DuckerMan. I am DuckerMan.&#8221;</p>
<p><strong>BK:</strong> Right. Well, according to Flashpoint, the Telegram user DuckerMan also used the alias Sergey Duck.</p>
<p><strong>Sergey:</strong> Yep, that&#8217;s me.</p>
<p><strong>BK:</strong> So you can see already how I arrived at your profile?</p>
<p><strong>Sergey:</strong> Yep, you&#8217;re a really good investigator.</p>
<p><strong>BK:</strong> I noticed this profile used to have a different name attached to it. A &#8216;Sergey Kryakov.&#8217;</p>
<p><strong>Sergey:</strong> It was my old surname. But I hated it so much I changed it.</p>
<p><strong>BK:</strong> What did you mean Binrs isn&#8217;t even a programmer?</p>
<p><strong>Sergey:</strong> I haven&#8217;t found any [of] his accounts on sites like GitHub/stack overflow. I&#8217;m not sure, does binrs sell Rust Clipper?</p>
<p><strong>BK:</strong> So you know his work! I take it that despite all of this, you maintain you are not involved in coding malware?</p>
<p><strong>Sergey:</strong> Well, no, but I have some &#8220;connections&#8221; with these guys. Speaking about Binrs, I&#8217;ve been researching his personality since October too.</p>
<p><strong>BK:</strong> Interesting. What made you want to research his personality? Also, please help me understand what you mean by &#8220;connections.&#8221;</p>
<p><strong>Sergey:</strong> I think he is actually a group of some people. I&#8217;ve written him on telegram from different accounts, and his way of speaking is different. Maybe some of them somehow tied with ALPHV. But on forums (I&#8217;ve checked only XSS and Exploit) his ways of speaking are the same.</p>
<p><strong>BK:</strong> &#8230;..</p>
<p><strong>Sergey:</strong> I don&#8217;t know how to explain this. By the way, binrs now is really silent, I think he&#8217;s lying low. Well, this is all I know.</p>
<p>No doubt he is. I enjoyed speaking with Sergey, but I also had difficulty believing most of what he said. Also, I was bothered that Sergey hadn&#8217;t exactly disputed the logic behind the clues that led to his VK account. In fact, he&#8217;d stated several times that he was impressed with the investigation.</p>
<p>In many <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank" rel="noopener">previous Breadcrumbs stories</a>, it is common at this point for the interviewee to claim they were being set up or framed. But Sergey never even floated the idea.</p>
<p>I asked Sergey what might explain all these connections if he wasn&#8217;t somehow involved in coding malicious software. His answer, our final exchange, was again equivocal.</p>
<p>&#8220;Well, all I have is code on my github,&#8221; he replied. &#8220;So it can be used [by] anyone, but I don&#8217;t think my projects suit for malwares.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58153
title: Fake Investor John Bernard Sinks Norwegian Green Shipping Dreams
uri: Fake-Investor-John-Bernard-Sinks-Norwegian-Green-Shipping-Dreams
url:
https://krebsonsecurity.com/2022/01/fake-investor-john-bernard-sinks-norwegian-green-shipping-dreams/

content:
<p>Several articles here have delved into the history of <strong>John Bernard</strong>, the pseudonym used by a fake billionaire technology investor who tricked dozens of start-ups into giving him tens of millions of dollars. Bernard&#8217;s latest victim &#8212; a Norwegian startup hoping to build a fleet of environmentally friendly shipping vessels &#8212; is now embroiled in a lawsuit over a deal gone bad, in which Bernard falsely claimed to have secured $100 million from six other wealthy investors, including the founder of <strong>Uber</strong> and the artist <strong>Abel Makkonen Tesfaye</strong>, better known as <strong>The Weeknd</strong>.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-58357" src="media/50fb8514.norkroner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/norkroner.png" alt="" width="743" height="405" /></p>
<p>John Bernard is a pseudonym used by <strong>John Clifton Davies</strong>, a convicted fraudster from the United Kingdom who is currently a fugitive from justice and residing in Ukraine. Davies&#8217; Bernard persona has fleeced dozens of technology companies out of an estimated $30 million with the promise of lucrative investments.</p>
<p>For several years until reinventing himself again quite recently, Bernard <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">pretended to be a billionaire Swiss investor</a> who made his fortunes in the dot-com boom 20 years ago and who was seeking investment opportunities. Bernard generated a stream of victims by offering extraordinarily generous finder&#8217;s fees for investment brokers who helped him secure new clients. But those brokers would eventually get stiffed as well because Bernard&#8217;s company would never consummate a deal.</p>
<p>In case after case, Bernard would promise to invest millions in tech startups, and then insist that companies pay tens of thousands of dollars worth of due diligence fees up front. However, the due diligence company he insisted on using — another Swiss firm called <strong>Inside Knowledge</strong> — also was secretly owned by Bernard, who would invariably pull out of the deal after receiving the due diligence money.</p>
<div id="attachment_53032" style="width: 694px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53032" loading="lazy" class="size-full wp-image-53032" src="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png" alt="" width="684" height="362" /><p id="caption-attachment-53032" class="wp-caption-text">The scam artist John Bernard (left) in a recent Zoom call, and a photo of John Clifton Davies from 2015.</p></div>
<p>But Bernard would adopt a slightly different approach to stealing from <strong>Freidig Shipping Ltd.</strong>, a Norwegian company formed in 2017 that was seeking the equivalent of USD $100 million investment to bring its green fleet of 30 new offshore service vessels to fruition.</p>
<p>Journalists <strong>Harald Vanvik</strong> and <strong>Harald Berglihn</strong> from the <em>Norwegian Business Daily</em> write that through investment advisors in London, Bernard was introduced to <strong>Nils-Odd Tønnevold</strong>, co-founder of Freidig Shipping and an investment advisor with 20 years of experience.</p>
<p>&#8220;Both Bernard and Inside Knowledge appeared to be professionals,&#8221; the reporters wrote in a story that&#8217;s behind a paywall. &#8220;Bernard appeared to be experienced. He knew a lot about start-ups and got into things quickly. Credible and reliable was the impression of him, said Tønnevold.&#8221;</p>
<p>&#8220;Bernard eventually took on the role of principal investor, claiming he had six other wealthy investors on the team, including artist Abel Makkonen Tesfaye, known as The Weeknd, Uber founder <strong>Garrett Camp</strong> and <strong>Norilsk Nickel</strong> owner Russian <strong>Vladimir Potanin</strong>,&#8221; the Norwegian journalists wrote. &#8220;These committed to contribute $99.25 million to Freidig.&#8221;</p>
<p>So in this case Bernard conveniently claimed he&#8217;d come up with almost all of the investment, which came $750,000 short of the goal. Another investor, a Belgian named <strong>Guy Devos</strong>, contributed the remaining $750,000.</p>
<p>But by the spring of 2020, it was clear that Devos and others involved in the shipping project had been tricked, and that all the money which had been paid to Bernard &#8212; an estimated NOK 15 million (~USD $1.67 million) &#8212; had been lost. By that time the two co-founders and their families had borrowed USD $1.5 million, and had transferred the funds to Inside Knowledge.<span id="more-58153"></span></p>
<p>&#8220;Further investigations indicated that Bernard was in fact a convicted and wanted Briton based in the Ukrainian capital Kiev,&#8221; the Norwegian Business Daily reported. &#8220;Guy Devos has sued Nils-Odd Tønnevold with a claim of 750,000 dollars because he believes Tønnevold has a responsibility for the money being transferred to Bernard. Tønnevold rejects this.&#8221;</p>
<p>Bernard&#8217;s scam is genius because he never approaches investors directly; rather, investors are incentivized to put his portfolio in front of tech firms seeking financial backing. And because the best cons begin as an idea or possibility planted in the target&#8217;s mind.</p>
<p>What&#8217;s remarkable about Freidig Shipping&#8217;s fleecing is that we heard about it at all. In the first of this now five-part series, we heard from <strong>Jason Kane</strong>, an attorney who focuses on investment fraud. Kane said companies bilked by small-time investment schemes rarely pursue legal action, mainly because the legal fees involved can quickly surpass the losses. What’s more, most victims will likely be too ashamed to come forward.</p>
<p>“These are cases where you might win but you’ll never collect any money,” Kane said. “This seems like an investment twist on those fairly simple scams we all can’t believe people fall for, but as scams go this one is pretty good. Do this a few times a year and you can make a decent living and no one is really going to come after you.”</p>
<p>It does appear that Bernard took advantage of a stunning lack of due diligence by the Freidig co-founders. In <a href="https://twitter.com/nilstonne/status/1264094232987553792" target="_blank" rel="noopener">this May 2020 post on Twitter</a> &#8212; well after their funds had already been transferred to Bernard &#8212; Nils-Odd Tønnevold can be seen asking Uber co-founder Garrett Camp if he indeed had agreed to invest in his company:</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-58356" src="media/98d89863.nils-odd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/nils-odd.png" alt="" width="590" height="412" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/nils-odd.png 590w, https://krebsonsecurity.com/wp-content/uploads/2022/01/nils-odd-100x70.png 100w" sizes="(max-width: 590px) 100vw, 590px" /></p>
<p><strong>John Clifton Davies</strong>, a.k.a. John Bernard, Jonathan Bibi, John Cavendish, is a U.K. man who absconded from justice before being convicted on multiple counts of fraud in 2015. Prior to his conviction, Davies served 16 months in jail on suspicion of murdering his third wife on their honeymoon in India. The U.K. authorities later dropped the murder charges for lack of evidence. Davies currently resides with his fourth wife in or near Kyiv, Ukraine.</p>
<p>If you liked this story, check out my previous reporting on John Bernard/Davies:</p>
<p><a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">Due Diligence That Money Can&#8217;t Buy</a></p>
<p><a href="https://krebsonsecurity.com/2020/09/who-is-tech-investor-john-bernard/" target="_blank" rel="noopener">Who is Tech Investor John Bernard?</a></p>
<p><a href="https://krebsonsecurity.com/2020/10/promising-infusions-of-cash-fake-investor-john-bernard-walked-away-with-30m/" target="_blank" rel="noopener">Promising Infusions of Cash, Fake Investor John Bernard Walked Away With $30 Million</a></p>
<p><a href="https://krebsonsecurity.com/2021/05/investment-scammer-john-davies-reinvents-himself/" target="_blank" rel="noopener">Investment Scammer John Davies Reinvents Himself?</a></p>


feed_id: https://krebsonsecurity.com/?p=58383
title: How Phishers Are Slinking Their Links Into LinkedIn
uri: How-Phishers-Are-Slinking-Their-Links-Into-LinkedIn
url: https://krebsonsecurity.com/2022/02/how-phishers-are-slinking-their-links-into-linkedin/
content:
<p><img loading="lazy" class="aligncenter wp-image-58391" src="media/1bea732f.redirect.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/redirect.png" alt="" width="760" height="460" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/02/redirect.png 1019w, https://krebsonsecurity.com/wp-content/uploads/2022/02/redirect-768x465.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/02/redirect-782x473.png 782w" sizes="(max-width: 760px) 100vw, 760px" /></p>
<p>If you received a link to <strong>LinkedIn.com</strong> via email, SMS or instant message, would you click it? Spammers, phishers and other ne&#8217;er-do-wells are hoping you will, because they&#8217;ve long taken advantage of a marketing feature on the business networking site which lets them create a LinkedIn.com link that bounces your browser to other websites, such as phishing pages that mimic top online brands (but chiefly Linkedin&#8217;s parent firm <strong>Microsoft</strong>).</p>
<p>At issue is a &#8220;redirect&#8221; feature available to businesses that chose to market through LinkedIn.com. The LinkedIn redirect links allow customers to track the performance of ad campaigns, while promoting off-site resources. These links or &#8220;<strong>Slinks</strong>&#8221; all have a standard format: &#8220;https://www.linkedin.com/slink?code=&#8221; followed by a short alphanumeric variable.</p>
<p>Here&#8217;s the very first Slink created: http://www.linkedin.com/slink?code=1, which redirects to the homepage for <strong>LinkedIn Marketing Solutions</strong>.</p>
<p>The trouble is, there&#8217;s little to stop criminals from leveraging newly registered or hacked LinkedIn business accounts to create their own ad campaigns using Slinks. <strong>Urlscan.io</strong>, a free service that provides detailed reports on any scanned URLs, also offers a historical look at suspicious links submitted by other users. <a href="https://urlscan.io/search/#task.domain%3Alinkedin.com%20AND%20task.url%3Aslink%20AND%20NOT%20page.domain%3Alinkedin.com" target="_blank" rel="noopener">This search via Urlscan</a> reveals dozens of recent phishing attacks that have leveraged the Slinks feature.</p>
<p>Here&#8217;s <a href="https://urlscan.io/result/74a84028-d554-43c1-a9ea-1618586c64f2/" target="_blank" rel="noopener">one example from Jan. 31</a> that uses Linkedin.com links to redirect anyone who clicks to a site that spoofs <strong>Adobe</strong>, and then prompts users to log in to their <strong>Microsoft</strong> email account to view a shared document.</p>
<div id="attachment_58387" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58387" loading="lazy" class="size-full wp-image-58387" src="media/6bf986d3.adobe-msphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/adobe-msphish.png" alt="" width="745" height="283" /><p id="caption-attachment-58387" class="wp-caption-text">A recent phishing site that abused LinkedIn&#8217;s marketing redirect. Image: Urlscan.io.</p></div>
<p>Urlscan also found <a href="https://urlscan.io/result/4b08c28c-b313-4d79-a6b0-f3ab301136dc/" target="_blank" rel="noopener">this phishing scam from Jan. 12</a> that uses Slinks to spoof the <strong>U.S. Internal Revenue Service</strong>. <a href="https://urlscan.io/result/00abef42-70a6-4e89-aa29-2ec951a8752f/#behaviour" target="_blank" rel="noopener">Here&#8217;s a Feb. 3 example</a> that leads to a phish targeting <strong>Amazon </strong>customers. <a href="https://urlscan.io/result/5bd64123-b19e-4f72-8cc9-0fc7b38c841e/" target="_blank" rel="noopener">This Nov. 26 sample from Urlscan</a> shows a LinkedIn link redirecting to a <strong>Paypal</strong> phishing page.<span id="more-58383"></span></p>
<p>Let me be clear that the activity described in this post is not new. Way back in 2016, security firm <strong>Fortinet</strong> <a href="https://www.fortinet.com/blog/threat-research/linkedin-and-baidu-redirecting-to-fat-loss-and-brain-improvement-scam" target="_blank" rel="noopener">blogged about LinkedIn&#8217;s redirect being used to promote phishing sites and online pharmacies</a>. More recently in late 2021, <strong>Jeremy Fuchs</strong> of <strong>Avanan</strong> wrote that the use of a LinkedIn URL may mean that any profession &#8212; the market for LinkedIn &#8212; could click.</p>
<p>&#8220;Plus, more employees have access to billing and invoice information, meaning that a spray-and-pray campaign can be effective,&#8221; Fuchs <a href="https://www.avanan.com/blog/shortened-linkedin-url-used-for-phishing" target="_blank" rel="noopener">wrote</a>. &#8220;The idea is to create a link that contains a clean page, redirecting to a phishing page.&#8221;</p>
<p>In a statement provided to KrebsOnSecurity, Linkedin said it has &#8220;industry standard technologies in place for URL sharing and chained redirects that help us identify and prevent the spread of malware, phishing and spam.&#8221; LinkedIn also said it uses 3rd party services &#8212; such as Google Safe Browsing, Spamhaus, Microsoft, and others &#8212; to identify known-bad URLs.</p>
<p>KrebsOnSecurity couldn&#8217;t find any evidence of phishers recently using LinkedIn&#8217;s redirect to phish LinkedIn credentials, but that&#8217;s certainly not out of the question. In a less complex attack, an adversary could send an email appearing to be a connection request from LinkedIn that redirects through LinkedIn to a malicious or phishous site.</p>
<p>Also, malicious or phishous emails that leverage LinkedIn&#8217;s Slinks are unlikely to be blocked by anti-spam or anti-malware filters, because LinkedIn is widely considered a trusted domain, and the redirect obscures the link&#8217;s ultimate destination.</p>
<p>Linkedin&#8217;s parent company &#8212; Microsoft Corp &#8212; is by all accounts the most-phished brand on the Internet today. A <a href="https://blog.checkpoint.com/2021/07/15/brand-phishing-report-q2-2021-microsoft-continues-reign/" target="_blank" rel="noopener">report last year</a> from <strong>Check Point</strong> found roughly 45 percent of all brand phishing attempts globally target Microsoft. Check Point said LinkedIn was the sixth most phished brand last year.</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages and other mediums. Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=58407
title: IRS To Ditch Biometric Requirement for Online Access
uri: IRS-To-Ditch-Biometric-Requirement-for-Online-Access
url: https://krebsonsecurity.com/2022/02/irs-to-ditch-biometric-requirement-for-online-access/
content:
<p><strong>The Internal Revenue Service</strong> (IRS) said today it will be transitioning away from requiring biometric data from taxpayers who wish to access their records at the agency&#8217;s website. The reversal comes as privacy experts and lawmakers have been pushing the IRS and other federal agencies to find less intrusive methods for validating one&#8217;s identity with the U.S. government online.</p>
<p><img loading="lazy" class="size-full wp-image-58161" src="media/15092662.irs-idme.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme.png" alt="" width="1175" height="866" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme.png 1175w, https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme-768x566.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme-782x576.png 782w" sizes="(max-width: 1175px) 100vw, 1175px" /></p>
<p>Late last year, the login page for the IRS was updated with text advising that by the summer of 2022, the only way for taxpayers to access their records at irs.gov will be through <strong>ID.me</strong>, an online identity verification service that collects biometric data &#8212; such as live facial scans using a mobile device or webcam.</p>
<p>The IRS first announced its partnership with ID.me in November, but the press release received virtually no attention. On Jan. 19, KrebsOnSecurity published the story <a href="https://krebsonsecurity.com/2022/01/irs-will-soon-require-selfies-for-online-access/" target="_blank" rel="noopener">IRS Will Soon Require Selfies for Online Access</a>, detailing a rocky experience signing up for IRS access via ID.me. That story immediately went viral, bringing this site an almost unprecedented amount of traffic. A tweet about it quickly garnered more than two million impressions.</p>
<p>It was clear most readers had no idea these new and more invasive requirements were being put in place at the IRS and other federal agencies (the Social Security Administration also is steering new signups to ID.me).</p>
<p>ID.me says it has approximately 64 million users, with 145,000 new users signing up each day. Still, the bulk of those users are people who have been forced to sign up with ID.me as a condition of receiving state or federal financial assistance, such as unemployment insurance, child tax credit payments, and pandemic assistance funds.</p>
<p>In the face of COVID, dozens of states collectively lost tens of billions of dollars at the hands of identity thieves impersonating out-of-work Americans seeking unemployment insurance. Some 30 states and 10 federal agencies now use ID.me to screen for ID thieves applying for benefits in someone else&#8217;s name.</p>
<p>But ID.me has been problematic for many legitimate applicants who saw benefits denied or delayed because they couldn&#8217;t complete ID.me&#8217;s verification process.  Critics charged the IRS&#8217;s plan would unfairly disadvantage people with disabilities or limited access to technology or Internet, and that facial recognition systems tend to be less accurate for people with darker skin.</p>
<p>Many readers were aghast that the IRS would ask people to hand over their biometric and personal data to a private company that begin in 2010 as a way to help veterans, teachers and other public servants qualify for retail discounts. These readers had reasonable questions: Who has (or will have) access to this data? Why should it be stored indefinitely (post-verification)? What happens if ID.me gets breached?</p>
<p><em>The Washington Post </em> <a href="https://www.washingtonpost.com/technology/2022/02/07/irs-gsa-id-facial-recogntion/?utm_campaign=wp_the_technology_202&amp;utm_medium=email&amp;utm_source=newsletter&amp;wpisrc=nl_technology202" target="_blank" rel="noopener">reported</a> today that in a meeting with lawmakers, IRS officials said they were considering another identity verification option that wouldn&#8217;t use facial recognition. At the same time, <strong>Senate Finance Committee Chairman Ron Wyden</strong> (D-Ore.) challenged the Treasury Department and IRS to reconsider the biometric requirements.</p>
<p>In a statement published today, the IRS said it was transitioning away from using a third-party service for facial recognition to help authenticate people creating new online accounts.</p>
<p>&#8220;The transition will occur over the coming weeks in order to prevent larger disruptions to taxpayers during filing season,&#8221; the IRS said. &#8220;During the transition, the IRS will quickly develop and bring online an additional authentication process that does not involve facial recognition. The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.&#8221;<span id="more-58407"></span></p>
<p>&#8220;The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised,&#8221; IRS Commissioner <strong>Chuck Rettig</strong> wrote. &#8220;Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition.&#8221;</p>
<p>The statement further stressed that the transition announced today does not interfere with the taxpayer’s ability to file their return or pay taxes owed. &#8220;During this period, the IRS will continue to accept tax filings, and it has no other impact on the current tax season,&#8221; the IRS said. &#8220;People should continue to file their taxes as they normally would.&#8221;</p>
<p>It remains unclear what other service or method the IRS will use going forward to validate the identities of new account signups. Wyden and others have urged the IRS to use Login.gov, a single sign-on service that Congress required federal agencies to use in 2015.</p>
<p>&#8220;Login.gov is already used to access 200 websites run by 28 Federal agencies and over 40 million Americans have accounts,&#8221; Wyden wrote in a letter to the IRS today. &#8220;Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity. The cost of this inaction has been billions of dollars in fraud, which has in turn fueled a black market for stolen personal data, and enabled companies like ID.me to commercialize what should be a core government service.&#8221;</p>
<p>Login.gov is run by the <strong>U.S. General Services Administration</strong>, which told The Post that it was &#8220;committed to not deploying facial recognition&#8230;or any other emerging technology for use with government benefits and services until a rigorous review has given us confidence that we can do so equitably and without causing harm to vulnerable populations.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58425
title: Microsoft Patch Tuesday, February 2022 Edition
uri: Microsoft-Patch-Tuesday-February-2022-Edition
url: https://krebsonsecurity.com/2022/02/microsoft-patch-tuesday-february-2022-edition/
content:
<p><img loading="lazy" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="763" height="537" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 763px) 100vw, 763px" /></p>
<p><strong>Microsoft</strong> today released software updates to plug security holes in its <strong>Windows</strong> operating systems and related software. This month&#8217;s relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it does fix four dozen flaws, including several that Microsoft says will likely soon be exploited by malware or malcontents.</p>
<p>While none of the patches address bugs that earned Microsoft&#8217;s most dire &#8220;critical&#8221; rating, there are multiple &#8220;remote code execution&#8221; vulnerabilities that Redmond believes are ripe for exploitation. Among those is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-22005" target="_blank" rel="noopener">CVE-2022-22005</a>, a weakness in Microsoft&#8217;s <strong>Sharepoint Server</strong> versions 2013-2019 that could be exploited by any authenticated user.</p>
<p>&#8220;The vulnerability does require an attacker to be authenticated in order to exploit it, which is likely why Microsoft only labeled it &#8216;Important,'&#8221; said <strong>Allan Liska</strong>, senior security architect at <strong>Recorded Future</strong>. &#8220;However, given the number of stolen credentials readily available on underground markets, getting authenticated could be trivial. Organizations that have public-facing SharePoint Servers should prioritize implementing this patch.&#8221;</p>
<p><strong>Kevin Breen</strong> at Immersive Labs called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21996" target="_blank" rel="noopener">CVE-2022-21996</a>, an elevation of privilege vulnerability in the core Windows component &#8220;<strong>Win32k</strong>.&#8221;</p>
<p>&#8220;In January we saw CVE-2022-21882, a vulnerability in Win32k that was being actively exploited in the wild, which prompted CISA to issue a directive to all federal agencies to mandate that patches be applied,&#8221; Breen said. &#8220;February sees more patches for the same style of vulnerability in this same component. It’s not clear from the release notes whether this is a brand new vulnerability or if it is related to the previous month’s update. Either way, we have seen attackers leverage this vulnerability so it’s safer to err on the side of caution and update this one quickly.&#8221;</p>
<p>Another elevation of privilege flaw <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21989" target="_blank" rel="noopener">CVE-2022-21989</a> &#8212; in the Windows Kernel &#8212; was the only vulnerability fixed this month that was publicly disclosed prior to today.</p>
<p>&#8220;Despite the lack of critical fixes, it&#8217;s worth remembering that attackers love to use elevation of privilege vulnerabilities, of which there are 18 this month,&#8221; said <strong>Greg Wiseman</strong>, product manager at <strong>Rapid7</strong>. &#8220;Remote code execution vulnerabilities are also important to patch, even if they may not be considered &#8216;wormable.&#8217; In terms of prioritization, defenders should first focus on patching server systems.&#8221;</p>
<p>February&#8217;s Patch Tuesday is once again brought to you by <strong>Print Spooler</strong>, the Windows component responsible for handling printing jobs. Four of the bugs quashed in this release relate to our friend Mr. Print Spooler. In July 2021, Microsoft issued an emergency fix for a Print Spooler flaw dubbed &#8220;<a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">PrintNightmare</a>&#8221; that was actively being exploited to remotely compromise Windows PCs. Redmond has been steadily spooling out patches for this service ever since.<span id="more-58425"></span></p>
<p>One important item to note this week is that Microsoft announced it will start blocking Internet macros by default in <strong>Office</strong>. This is a big deal because malicious macros hidden in Office documents have become a huge source of intrusions for organizations, and they are often the initial vector for ransomware attacks.</p>
<p>As <strong>Andrew Cunningham</strong> writes for <em>Ars Technica</em>, under the new regime when files that use macros are downloaded from the Internet, those macros will now be disabled entirely by default. The change will also be enabled for all currently supported standalone versions of Office, including versions 2021, 2019, 2016, and 2013.</p>
<p>&#8220;Current versions of the software offer an alert banner on these kinds of files that can be clicked through, but the new version of the banner offers no way to enable the macros,&#8221; Cunningham <a href="https://arstechnica.com/gadgets/2022/02/microsoft-will-block-downloaded-macros-in-office-versions-going-back-to-2013/" target="_blank" rel="noopener">wrote</a>. &#8220;The change will be previewed starting in April before being rolled out to all users of the continuously updated Microsoft 365 version of Office starting in June.&#8221;</p>
<p>January’s patch release was a tad heavier and rockier than most, with Microsoft forced to re-issue several patches to address unexpected issues caused by the updates. Breen said while February&#8217;s comparatively light burden should give system administrators some breathing room, it shouldn&#8217;t be viewed as an excuse to skip updates.</p>
<p>&#8220;But it does reinforce how important it is to test patches in a staging environment or use a staggered rollout, and why monitoring for any adverse impacts should always be a key step in your patching policy,&#8221; Breen said.</p>
<p>For a complete rundown of all patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+February+2022+Patch+Tuesday/28316/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/2021/defcon-2-august-updates-include-print-spooler-fixes/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these patches, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=58435
title: Russian Govt. Continues Carding Shop Crackdown
uri: Russian-Govt-Continues-Carding-Shop-Crackdown
url: https://krebsonsecurity.com/2022/02/russian-govt-continues-carding-shop-crackdown/
content:
<p>Russian authorities have arrested six men accused of operating some of the most active online bazaars for selling stolen payment card data. The crackdown &#8212; the second closure of major card fraud shops by Russian authorities in as many weeks &#8212; comes closely behind <a href="https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/" target="_blank" rel="noopener">Russia&#8217;s arrest of 14 alleged affiliates of the REvil ransomware gang</a>, and has many in the cybercrime underground asking who might be next.</p>
<div id="attachment_58442" style="width: 770px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58442" loading="lazy" class=" wp-image-58442" src="media/e85102c0.deptk-td.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/deptk-td.png" alt="" width="760" height="490" /><p id="caption-attachment-58442" class="wp-caption-text">Dept. K&#8217;s message for Trump&#8217;s Dumps users.</p></div>
<p>On Feb. 7 and 8, the domains for the carding shops <a href="https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/" target="_blank" rel="noopener">Trump&#8217;s Dumps</a>, <strong>Ferum Shop</strong>, <strong>Sky-Fraud</strong> and <strong>UAS</strong> were seized by <strong>Department K</strong>, a division of the <a href="https://en.wikipedia.org/wiki/Ministry_of_Internal_Affairs_(Russia)" target="_blank" rel="noopener">Ministry of Internal Affairs of the Russian Federation</a> that focuses on computer crimes. The websites for the carding stores were retrofitted with a message from Dept. K asking, &#8220;Which one of you is next?&#8221;</p>
<p>According to cyber intelligence analysts at <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, that same message was included in the website for <strong>UniCC</strong>, another major and venerated carding shop that was seized by Dept. K in January.</p>
<p>Around the same time Trump&#8217;s Dumps and the other three shops began displaying the Dept. K message, the Russian state-owned news outlet <strong>TASS</strong> <a href="https://tass.ru/obschestvo/13637797" target="_blank" rel="noopener">moved a story</a> naming six Russian men who were being charged with &#8220;the illegal circulation of means of payment.&#8221;</p>
<p>TASS reports the six detained include <strong>Denis Pachevsky</strong>, general director of Saratovfilm Film Company LLC; <strong>Alexander Kovalev</strong>, an individual entrepreneur; <strong>Artem Bystrykh</strong>, an employee of Transtekhkom LLC; <strong>Artem Zaitsev</strong>; an employee of <strong>Get-net LLC</strong>; and two unemployed workers, <strong>Vladislav Gilev</strong> and <strong>Yaroslav Solovyov</strong>.</p>
<p>None of the stories about the arrests tie the men to the four carding sites. But Flashpoint found that all of the domains seized by Dept. K. were registered and hosted through Zaitsev&#8217;s company &#8212; Get-net LLC.</p>
<p>&#8220;All four sites frequently advertised one another, which is generally atypical for two card marketplaces competing in the same space,&#8221; Flashpoint analysts wrote.</p>
<p><strong>Stas Alforov</strong> is director of research for <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener">Gemini Advisory</a>, a New York firm that monitors underground cybercrime markets. Alforov said it is most unusual for the Russians to go after carding sites that aren&#8217;t selling data stolen from Russian citizens.</p>
<p>&#8220;It&#8217;s not in their business to be taking down Russian card shops,&#8221; Alforov said. &#8220;Unless those shops were somehow selling data on Russian cardholders, which they weren&#8217;t.&#8221;</p>
<div id="attachment_39492" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-39492" loading="lazy" class=" wp-image-39492" src="media/8065c765.trumpsdumps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps.png" alt="" width="761" height="519" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps.png 1295w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-768x524.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-940x641.png 940w" sizes="(max-width: 761px) 100vw, 761px" /><p id="caption-attachment-39492" class="wp-caption-text">A carding shop that sold stolen credit cards and invoked 45&#8217;s likeness and name was among those taken down this week by Russian authorities.</p></div>
<p>Debuting in 2011, Ferum Shop is one of the oldest observed dark web marketplaces selling &#8220;card not present&#8221; data (customer payment records stolen from hacked online merchants), according to Gemini.</p>
<p>&#8220;Every year for the last 5 years, the marketplace has been a top 5 source of card not present records in terms of records posted for sale,&#8221; Gemini found. &#8220;In this time period, roughly 66% of Ferum Shop’s records have been from United States financial institutions. The remaining 34% have come from over 200 countries.&#8221;</p>
<p>In contrast, Trump’s Dumps focuses on selling card data stolen from hacked point-of-sale devices, and it benefited greatly from <a href="https://krebsonsecurity.com/2021/01/jokers-stash-carding-market-to-call-it-quits/" target="_blank" rel="noopener">the January 2021 retirement of Joker&#8217;s Stash</a>, which for years dwarfed most other carding shops by volume. Gemini found Trump&#8217;s Dumps gained roughly 40 percent market share after Joker&#8217;s closure, and that more than 87 percent of the payment card records it sells are from U.S. financial institutions.</p>
<p>&#8220;In the past 5 years, Ferum Shop and Trump&#8217;s Dumps have cumulatively added over 64 million compromised payment cards,&#8221; Alforov wrote. &#8220;Based on average demand for CP and CNP records and the median price of $10, the total revenue from these sales is estimated to be over $430 million. Due to the 20 to 30% commission that shops generally receive, the administrators of Ferum Shop and Trump&#8217;s Dumps likely generated between $86 and $129 million in profits from these card sales.&#8221;<span id="more-58435"></span></p>
<p>The arrests of the six men comes less than two weeks after Russian law enforcement officials detained four suspected carders &#8212; including <strong>Andrey Sergeevich Novak</strong>, the reputed owner of the extremely popular and long-running <strong>UniCC</strong> carding shop.</p>
<p>In 2018, the U.S. Justice Department <a href="https://krebsonsecurity.com/2018/02/u-s-arrests-13-charges-36-in-infraud-cybercrime-forum-bust/" target="_blank" rel="noopener">charged Novak and three dozen other defendants</a> thought to be key members of &#8220;<strong>Infraud</strong>,&#8221; a long-running cybercrime forum that prosecutors say cost merchants and consumers more than half a billion dollars.</p>
<div id="attachment_42488" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-42488" loading="lazy" class=" wp-image-42488" src="media/f291787c.unicc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/unicc.png" alt="" width="754" height="473" /><p id="caption-attachment-42488" class="wp-caption-text">Unicc shop, which sold stolen credit card data as well as Social Security numbers and other consumer information that can be used for identity theft. It was seized by Dept. K in January 2020.</p></div>
<p>Flashpoint said the recent arrests represent the first major actions against Russia-based cybercriminals since March 2020, when <a href="https://krebsonsecurity.com/2020/03/russians-shut-down-huge-card-fraud-ring/" target="_blank" rel="noopener">the FSB detained more than thirty members of an illicit carding operation</a>, charging twenty-five of them with &#8220;illegal circulation of means of payment.&#8221;</p>
<p>Dumps, or card data stolen from compromised point-of-sale devices, have been declining in popularity among fraudsters for years as more financial institutions have issued more secure chip-based cards. In contrast, card-not-present data stolen from online stores continues to be in high demand, because it helps facilitate fraud at online retailers. Gemini says the supply of card-not-present data rose by 50 percent in 2021 versus 2020, fed largely by the success of <a href="https://krebsonsecurity.com/?s=magecart" target="_blank" rel="noopener">Magecart e-skimmers that target vulnerabilities in e-commerce sites</a>.</p>
<p>Alforov says while the carding shop closures are curiously timed, he doubts the supply of stolen card data is going to somehow shrink as a result. Rather, he said, some of the lower-tier card shops that were previously just resellers working with Trump&#8217;s Dumps and others are now suddenly ramping up inventory with their own new suppliers &#8212; very likely thanks to the same crooks who were selling cards to the six men arrested this week in Russia.</p>
<p>&#8220;What we&#8217;re seeing now is a lot of those reseller shops are coming to the market and saying, &#8216;We don&#8217;t have that order data we were getting from Ferum Shop but now have our own vendors,'&#8221; Alforov said. &#8220;Some of the lesser tier shops are starting to move up the food chain.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58373
title: Wazawaka Goes Waka Waka
uri: Wazawaka-Goes-Waka-Waka
url: https://krebsonsecurity.com/2022/02/wazawaka-goes-waka-waka/
content:
<p>In January, KrebsOnSecurity examined clues left behind by &#8220;<strong>Wazawaka</strong>,&#8221; the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since &#8220;lost his mind&#8221; according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance, and publishing bizarre selfie videos taunting security researchers and journalists.</p>
<div id="attachment_58465" style="width: 346px" class="wp-caption alignright"><img aria-describedby="caption-attachment-58465" loading="lazy" class=" wp-image-58465" src="media/7266f203.wazaboris.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris.png" alt="" width="336" height="321" /><p id="caption-attachment-58465" class="wp-caption-text">Wazawaka, a.k.a. Mikhail P. Matveev, a.k.a. &#8220;Orange,&#8221; a.k.a. &#8220;Boriselcin,&#8221; showing off his missing ring finger.</p></div>
<p>In <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">last month&#8217;s story</a>, we explored clues that led from Wazawaka&#8217;s multitude of monikers, email addresses, and passwords to a 30-something father in Abakan, Russia named <strong>Mikhail Pavlovich Matveev</strong>. This post concerns itself with the other half of Wazawaka&#8217;s identities not mentioned in the first story, such as how Wazawaka also ran the <strong>Babuk</strong> ransomware affiliate program, and later became &#8220;<strong>Orange</strong>,&#8221; the founder of the ransomware-focused Dark Web forum known as &#8220;<strong>RAMP</strong>.&#8221;</p>
<p>The same day the initial profile on Wazawaka was published here, someone registered the Twitter account &#8220;<a href="media/580346a8.waza-twitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/waza-twitter.png" target="_blank" rel="noopener"><strong>@fuck_maze</strong></a>,&#8221; a possible reference to the now-defunct Maze Ransomware gang.</p>
<p>The background photo for the @fuck_maze profile included a logo that read &#8220;Waka Waka;&#8221; the bio for the account took a swipe at <a href="https://twitter.com/ddd1ms?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor" target="_blank" rel="noopener">Dmitry Smilyanets</a>, a researcher and blogger for <a href="https://therecord.media" target="_blank" rel="noopener">The Record</a> who was once part of a cybercrime group the Justice Department <a href="https://www.justice.gov/opa/pr/russian-national-admits-role-largest-known-data-breach-conspiracy-ever-prosecuted" target="_blank" rel="noopener">called</a> the &#8220;largest known data breach conspiracy ever prosecuted.&#8221;</p>
<p>The @fuck_maze account messaged me a few times on Twitter, but largely stayed silent until Jan. 25, when it tweeted three videos of a man who appeared identical to <a href="media/5b0cfcba.wazawaka-vk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/wazawaka-vk.png" target="_blank" rel="noopener">Matveev&#8217;s social media profile on Vkontakte</a> (the Russian version of Facebook). The man seemed to be slurring his words quite a bit, and started by hurling obscenities at Smilyanets, journalist <a href="https://twitter.com/campuscodi" target="_blank" rel="noopener">Catalin Cimpanu</a> (also at The Record), and <a href="https://twitter.com/AShukuhi" target="_blank" rel="noopener">a security researcher from Cisco Talos</a>.</p>
<p>At the beginning of the videos, Matveev holds up his left hand to demonstrate that his ring finger is missing. This he smugly presents as evidence that he is indeed Wazawaka.</p>
<p>The story goes that Wazwaka at one point made a bet wherein he wagered his finger, and upon losing the bet severed it himself. It&#8217;s unclear if that is the real story about how Wazawaka lost the ring finger on his left hand; his remaining fingers appear oddly crooked.</p>
<p>&#8220;Hello Brian Krebs! You did a really great job actually, really well, fucking great — it&#8217;s great that journalism works so well in the US,&#8221; Matveev said in the video. &#8220;By the way, it is my voice in the background, I just love myself a lot.&#8221;</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/G1LclbndLaM" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In one of his three videos, Wazawaka says he&#8217;s going to release exploit code for a security vulnerability. Later that same day, the @fuck_maze account posted a link to a Pastebin-like site that included working exploit code for a recently patched security hole in SonicWall VPN appliances (<a href="https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017" target="_blank" rel="noopener">CVE-2021-20028</a>).</p>
<p>When KrebsOnSecurity first started researching Wazawaka in 2021, it appeared this individual also used two other important nicknames on the Russian-speaking crime forums. One was <strong>Boriselcin</strong>, a particularly talkative and brash personality who was simultaneously the public persona of Babuk, a ransomware affiliate program that surfaced on New Year&#8217;s Eve 2020.</p>
<p>The other handle that appeared tied to Wazawaka was &#8220;Orange,&#8221; the founder of <a href="https://ke-la.com/new-russian-speaking-forum-a-new-place-for-raas/" target="_blank" rel="noopener">the RAMP ransomware forum</a>. I just couldn&#8217;t convincingly connect those two identities with Wazawaka using the information available at the time. This post is an attempt to remedy that.<span id="more-58373"></span></p>
<p>On Aug. 26, 2020, a new user named <strong>Biba99</strong> registered on the English language cybercrime forum <strong>RaidForums</strong>. But the Biba99 account didn&#8217;t post to RaidForums until Dec. 31, 2020, when they announced the creation of the Babuk ransomware affiliate program.</p>
<p>On January 1, 2021, a new user &#8220;Babuk&#8221; registered on the crime forum Verified, using the email address <strong>teresacox19963@gmail.com</strong>, and the instant message address &#8220;admin@babuk.im.&#8221; &#8220;We run an affiliate program,&#8221; Babuk explained in their introductory post on Verified.</p>
<p>A variety of clues suggest Boriselcin was the individual acting as spokesperson for Babuk. Boriselcin talked openly on the forums about working with Babuk, and fought with other members of the ransomware gang about publishing access to data stolen from victim organizations.</p>
<p>According to analysts at cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, between January and the end of March 2021, Babuk continued to post databases stolen from companies that refused to pay a ransom, but they posted the leaks to both their victim shaming blog and to multiple cybercrime forums, an unusual approach.</p>
<p>This matches the ethos and activity of Wazawaka&#8217;s posts on the crime forums over the past two years. As I wrote in January:</p>
<blockquote><p>&#8220;Wazawaka seems to have adopted the uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder — not privately sold to the highest bidder. In thread after thread on the crime forum XSS, Wazawaka’s alias &#8216;Uhodiransomwar&#8217; can be seen posting download links to databases from companies that have refused to negotiate after five days.&#8221;</p></blockquote>
<p>Around Apr. 27, 2021, Babuk hacked the <strong>Washington Metropolitan Police Department</strong>, demanding $4 million in virtual currency in exchange for a promise not to publish the police department&#8217;s internal data.</p>
<p>Flashpoint says that on April 30, Babuk announced they were shuttering the affiliate program and its encryption services, and that they would now focus on data theft and extortion instead. On May 3, the group posted two additional victims of their data theft enterprise, showing they are still in operation.</p>
<p>On May 11, 2021, Babuk declared negotiations with the MPD had reached an impasse, and <a href="https://www.nbcnews.com/tech/security/hackers-release-personal-info-22-dc-police-officers-rcna897" target="_blank" rel="noopener">leaked 250 gigabytes worth of MPD data</a>.</p>
<p>On May 14, 2021, Boriselcin announced on XSS his intention to post a writeup on how they hacked the DC Police (Boriselcin claims it was via the organization&#8217;s VPN).</p>
<p>On May 17, Babuk posted about an upcoming new ransomware leaks site that will serve as a &#8220;huge platform for independent leaks,&#8221; &#8212; i.e., a community that would publish data stolen by no-name ransomware groups that don&#8217;t already have their own leaks/victim shaming platforms.</p>
<p>On May 31, 2021, Babuk&#8217;s website began redirecting to Payload[.]bin. On June 23, 2021, Biba99 posted to RaidForums saying he&#8217;s willing to buy zero-day vulnerabilities in corporate VPN products. Biba99 posts his unique user ID for <a href="https://en.wikipedia.org/wiki/Tox_(protocol)" target="_blank" rel="noopener">Tox</a>, a peer-to-peer instant messaging service.</p>
<p>On July 13, 2021, Payload[.]bin was renamed to RAMP, which according to Orange stands for &#8220;Ransom Anon Market Place.&#8221; Flashpoint says RAMP was created &#8220;directly in response to several large Dark Web forums banning ransomware collectives on their site following <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the Colonial Pipeline attack</a> by ransomware group &#8216;<a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener">DarkSide</a>.&#8221; [links added]</p>
<p>&#8220;Babuk noted that this new platform will not have rules or &#8216;bosses,'&#8221; Flashpoint observed in a report on the group. &#8220;This reaction distinguishes Babuk from other ransomware collectives, many of which changed their rules following the attack to attract less attention from law enforcement.&#8221;</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/Mhl9lImljBE" width="760" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The RAMP forum opening was announced by the user &#8220;<strong>TetyaSluha</strong>. That nickname soon switched to &#8220;Orange,&#8221; who appears to have registered on RAMP with the email address &#8220;teresacox19963@gmail.com.&#8221; Recall that this is the same email address used by the spokesperson for the Babuk ransomware gang &#8212; Boriselcin/Biba99.</p>
<p>In a post on RAMP Aug. 18, 2021, in which Orange is attempting <a href="https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of-riches-ransom-gangs-increasingly-outsource-their-work/" target="_blank" rel="noopener">to recruit penetration testers</a>, he claimed the same Tox ID that Biba99 used on RaidForums.</p>
<p>On Aug. 22, Orange announced a new ransomware affiliate program called &#8220;<strong>Groove</strong>,&#8221; which claimed to be an aggressive, financially motivated criminal organization dealing in industrial espionage for the previous two years.</p>
<p>In November 2021, Groove&#8217;s blog disappeared, and Boriselcin posted a long article to the XSS crime forum explaining that <a href="https://krebsonsecurity.com/2021/11/the-groove-ransomware-gang-was-a-hoax/" target="_blank" rel="noopener">Groove was little more than a pet project to mess with the media and security industries</a>.</p>
<p>On Sept. 13, 2021, Boriselcin posted to XSS saying he would pay handsomely for a reliable, working exploit for CVE-2021-20028, the same exploit that @fuck_maze would later release to Twitter on Jan. 25, 2022.</p>
<p>Asked for comment on this research, cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> confirmed that its analysts reached the same conclusion.</p>
<p>&#8220;We identified the user as the Russian national Михаил Павлович Матвеев aka Mikhail Pavlovich Matveev, who was widely known in the underground community as the actor using the Wazawaka handle, a.k.a. Alfredpetr, andry1976, arestedByFbi, boriselcin, donaldo, ebanatv2, futurama, gotowork, m0sad, m1x, Ment0s, ment0s, Ment0s, Mixalen, mrbotnet, Orange, posholnarabotu, popalvprosak, TetyaSluha, uhodiransomwar, and 999,&#8221; Intel 471 wrote.</p>
<p>As usual, I put together a rough mind map on how all these data points indicate a connection between Wazawaka, Orange, and Boriselcin.</p>
<div id="attachment_58487" style="width: 769px" class="wp-caption aligncenter"><a href="media/bb4c8356.wazaboris-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58487" loading="lazy" class="wp-image-58487" src="media/bb4c8356.wazaboris-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris-mm.png" alt="" width="759" height="373" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris-mm.png 1675w, https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris-mm-768x377.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris-mm-1536x755.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/02/wazaboris-mm-782x384.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></a><p id="caption-attachment-58487" class="wp-caption-text">A mind map connecting Wazawaka to the RAMP forum administrator &#8220;Orange&#8221; and the founder of the Babuk ransomware gang.</p></div>
<p>As noted in January&#8217;s profile, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.</p>
<p>Wazawaka also said he’d teamed up with DarkSide, the ransomware affiliate group responsible for the six-day outage at Colonial Pipeline last year that caused nationwide fuel shortages and price spikes. The U.S. Department of State has since offered a $5 million reward for information leading to the arrest and conviction of any DarkSide affiliates.</p>


feed_id: https://krebsonsecurity.com/?p=58533
title: Red Cross Hack Linked to Iranian Influence Operation?
uri: Red-Cross-Hack-Linked-to-Iranian-Influence-Operation
url: https://krebsonsecurity.com/2022/02/red-cross-hack-linked-to-iranian-influence-operation/
content:
<p>A network intrusion at the <strong>International Committee for the Red Cross</strong> (ICRC) in January led to the theft of personal information on more than 500,000 people receiving assistance from the group. KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the stolen ICRC data also was used to register multiple domain names the FBI says are tied to a sprawling media influence operation originating from Iran.</p>
<p><img loading="lazy" class="aligncenter wp-image-58567" src="media/a1920b50.icrc-sca.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/icrc-sca.png" alt="" width="758" height="316" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/02/icrc-sca.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2022/02/icrc-sca-768x320.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/02/icrc-sca-782x326.png 782w" sizes="(max-width: 758px) 100vw, 758px" /></p>
<p>On Jan. 19, the ICRC disclosed the compromise of servers hosting the personal information of more than 500,000 people receiving services from the <a href="https://en.wikipedia.org/wiki/International_Red_Cross_and_Red_Crescent_Movement" target="_blank" rel="noopener">Red Cross and Red Crescent Movement</a>. The ICRC said the hacked servers contained data relating to the organization&#8217;s <strong>Restoring Family Links</strong> services, which works to reconnect people separated by war, violence, migration and other causes.</p>
<p>The same day the ICRC went public with its breach, someone using the nickname &#8220;<strong>Sheriff</strong>&#8221; on the English-language cybercrime forum <strong>RaidForums</strong> advertised the sale of data from the Red Cross and Red Crescent Movement. Sheriff&#8217;s sales thread suggests the ICRC was asked to pay a ransom to guarantee the data wouldn&#8217;t be leaked or sold online.</p>
<p>&#8220;Mr. Mardini, your words have been heard,&#8221; Sheriff wrote, posting a link to the Twitter profile of <strong>ICRC General Director Robert Mardini</strong> and urging forum members to tell him to check his email. &#8220;Check your email and send a figure you can pay.&#8221;</p>
<div id="attachment_58541" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58541" loading="lazy" class="size-full wp-image-58541" src="media/ebdca886.sheriff-icrc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/sheriff-icrc.png" alt="" width="757" height="700" /><p id="caption-attachment-58541" class="wp-caption-text">RaidForums member &#8220;unindicted&#8221; aka Sheriff selling access to the International Red Cross and Red Crescent Movement data. Image: Ke-la.com</p></div>
<p>In their <a href="https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know" target="_blank" rel="noopener">online statement about the hack</a> (updated on Feb. 7) the ICRC said it had not had any contact with the hackers, and no ransom demand had been made.</p>
<p>&#8220;In line with our standing practice to engage with any actor who can facilitate or impede our humanitarian work, we are willing to communicate directly and confidentially with whoever may be responsible for this operation to impress upon them the need to respect our humanitarian action,&#8221; the ICRC statement reads.</p>
<p>Asked to comment on Sheriff&#8217;s claims, the ICRC issued the following statement:</p>
<p>&#8220;Right now, we do not have any conclusive evidence that this information from the data breach has been published or is being traded. Our cybersecurity team has looked into any reported allegation of data being available on the dark web.&#8221;</p>
<p>The email address that Sheriff used to register at RaidForums &#8212; <strong>kelvinmiddelkoop@hotmail.com</strong> &#8212; appears in <a href="https://www.justice.gov/usao-ndca/press-release/file/1334571/download" target="_blank" rel="noopener">an affidavit for a search warrant filed by the FBI</a> roughly a year ago. That FBI warrant came on the heels of <a href="https://www.mandiant.com/resources/report-suspected-iranian-influence-operation" target="_blank" rel="noopener">an investigation published by security firm <strong>FireEye</strong></a>, which examined an Iranian-based network of inauthentic news sites and social media accounts aimed at the United States., U.K. and other western audiences.</p>
<p>&#8220;This operation is leveraging a network of inauthentic news sites and clusters of associated accounts across multiple social media platforms to promote political narratives in line with Iranian interests,&#8221; FireEye researchers wrote. &#8220;These narratives include anti-Saudi, anti-Israeli, and pro-Palestinian themes, as well as support for specific U.S. policies favorable to Iran.&#8221;</p>
<div id="attachment_58542" style="width: 773px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58542" loading="lazy" class=" wp-image-58542" src="media/668964eb.lfp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/lfp.png" alt="" width="763" height="429" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/02/lfp.png 1419w, https://krebsonsecurity.com/wp-content/uploads/2022/02/lfp-768x431.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/02/lfp-782x439.png 782w" sizes="(max-width: 763px) 100vw, 763px" /><p id="caption-attachment-58542" class="wp-caption-text">The FBI says the domains registered by the email address tied to Sheriff&#8217;s RaidForums account were used in service of the Liberty Front Press, a network of phony news sites thought to originate from Iran.</p></div>
<p>According to the FBI affidavit, the address kelvinmiddelkoop@hotmail.com was used to register at least three different domains for phony news sites, including awdnews[.]com, sachtimes[.]com, and whatsupic[.]com. A reverse WHOIS search on that email address at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> (an advertiser on this site) shows it was used to register 17 domains between 2012 and 2021, including moslimyouthmedia[.]com, moslempress[.]com, and realneinovosti[.]net.<span id="more-58533"></span></p>
<p>A review of Sheriff&#8217;s postings to RaidForum reveals he has used two other nicknames since registering on the forum in December 2021: &#8220;<strong>Unindicted</strong>,&#8221; and &#8220;<strong>threat_actor</strong>.&#8221; In several posts, Sheriff taunts one FireEye employee by name.</p>
<p>In a Jan. 3, 2022 post, Sheriff says their &#8220;team&#8221; is seeking licenses for the Cobalt Strike penetration testing tool, and that they&#8217;re prepared to pay $3,000 &#8211; $4,000 per license. Cobalt Strike is a legitimate security product that is sold only to vetted partners, but compromised or ill-gotten Cobalt Strike licenses <a href="https://www.secureworks.com/blog/detecting-cobalt-strike-cybercrime-attacks" target="_blank" rel="noopener">frequently are used in the run-up to ransomware attacks</a>.</p>
<p>&#8220;We will buy constantly, make contact,&#8221; Sheriff advised. &#8220;Do not ask if we still need)) the team is interested in licenses indefinitely.&#8221;</p>
<p>On Jan. 4, 2022, Sheriff tells RaidForums that their team is in need of access to a specific data broker platform, and offers to pay as much as $35,000 for that access. Sheriff says they will only accept offers that are guaranteed through the forum&#8217;s escrow account.</p>
<p>The demand for escrow in a sales thread is almost universally a sign that someone means business and they are ready to transact on whatever was advertised or requested. That&#8217;s because escrow transactions necessarily force the buyer to make a deposit with the forum&#8217;s administrators before proceeding on any transaction.</p>
<p>Sheriff appears to have been part of a group on RaidForums that <a href="media/a432a678.kela-scrape.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/kela-scrape.pdf" target="_blank" rel="noopener">offered to buy access to organizations that could be extorted with ransomware or threatened with the publication of stolen data</a> (PDF screenshot from threat intelligence firm <a href="https://ke-la.com" target="_blank" rel="noopener">KELA</a>). In a &#8220;scam report&#8221; filed against Sheriff by another RaidForums member on Dec. 31, 2021, the claimant says Sheriff bought access from them and agreed to pay 70 percent of any ransom paid by the victim organization.</p>
<p>Instead, the claimant maintains, Sheriff only paid them roughly 25 percent. &#8220;The company pay $1.35 million ransom and only payment was made of $350k to me, so i ask for $600k to fix this dispute,&#8221; the affiliate wrote.</p>
<p>In another post on RaidForums, a user aptly named &#8220;FBI Agent&#8221; advised other denizens to steer clear of Sheriff&#8217;s ransomware affiliate program, noting that transacting with this person could run afoul of sanctions from the U.S. Department of the Treasury&#8217;s <strong>Office of Foreign Assets Control</strong> (OFAC) that restrict commerce with people residing in Iran.</p>
<p>&#8220;To make it clear, we don&#8217;t work with individuals under the OFAC sanctions list, which @Sheriff is under,&#8221; the ransomware affiliate program administrator wrote in reply.</p>
<p>RaidForums says Sheriff was referred to the forum by <strong>Pompompurin</strong>, the same hacker who used a security hole in the FBI&#8217;s website last year <a href="https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/" target="_blank" rel="noopener">to blast a phony alert about a cybercrime investigation to state and local authorities</a>. Pompompurin has been quite active on RaidForums for the past few years, frequently posting databases from newly-hacked organizations, and <a href="https://www.securityweek.com/fbi-hacker-offers-sell-data-allegedly-stolen-robinhood-breach" target="_blank" rel="noopener">selling access to stolen information</a>.</p>
<p>Reach via Twitter, Pompompurin said they had no idea who might have offered money and information on Sheriff, and that they would never &#8220;snitch&#8221; on Sheriff.</p>
<p>&#8220;I know who he is but I&#8217;m not saying anything,&#8221; Pompompurin replied.</p>
<p>The information about Sheriff was brought to my attention by an anonymous person who initially contacted KrebsOnSecurity saying they wanted to make a donation to the publication. When the person offering the gift asked if it was okay that the money came from a ransomware transaction, I naturally declined the offer.</p>
<p>That person then proceeded to share the information about the connection between Sheriff&#8217;s email address and the FBI search warrant, as well as the account&#8217;s credentials.</p>
<p>The same identity approached several other security researchers and journalists, one of whom was able to validate that the kelvinmiddelkoop@hotmail.com address actually belonged to Sheriff&#8217;s account. Those researchers were likewise offered tainted donations, except the individual offering the donation seemed to use a different story with each person about who they were or why they were offering money. Others contacted by the same anonymous user said they also received unsolicited details about Sheriff.</p>
<p>It seems clear that whoever offered that money and information has their own agenda, which may also involve attempts to make members of the news media appear untrustworthy for agreeing to accept stolen funds. However, the information they shared checks out, and since there is precious little public reporting on the source of the ICRC intrusion, the potential connection to hacker groups based in Iran seems worth noting.</p>


feed_id: https://krebsonsecurity.com/?p=58607
title: Report: Missouri Governor’s Office Responsible for Teacher Data Leak
uri: Report-Missouri-Governor-s-Office-Responsible-for-Teacher-Data-Leak
url:
https://krebsonsecurity.com/2022/02/report-missouri-governors-office-responsible-for-teacher-data-leak/

content:
<p><strong>Missouri Governor Mike Parson</strong> made headlines last year when he <a href="https://krebsonsecurity.com/2021/10/missouri-governor-vows-to-prosecute-st-louis-post-dispatch-for-reporting-security-vulnerability/" target="_blank" rel="noopener">vowed to criminally prosecute a journalist</a> for reporting a security flaw in a state website that exposed personal information of more than 100,000 teachers. But Missouri prosecutors now say they will not pursue charges following revelations that the data had been exposed since 2011 &#8212; two years after responsibility for securing the state&#8217;s IT systems was centralized within Parson&#8217;s own Office of Administration.</p>
<div id="attachment_57297" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57297" loading="lazy" class=" wp-image-57297" src="media/f2f8b85a.parson.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/parson.png" alt="" width="764" height="421" /><p id="caption-attachment-57297" class="wp-caption-text">Missouri Gov. Mike Parson (R), vowing to prosecute the St. Louis Post-Dispatch for reporting a security vulnerability that exposed teacher SSNs.</p></div>
<p>In October 2021, St. Louis Post-Dispatch reporter <a href="https://www.stltoday.com/users/profile/jrenaud" target="_blank" rel="noopener">Josh Renaud</a> alerted Missouri education department officials that their website was exposing the Social Security numbers of more than 100,000 primary and secondary teachers in the state. Renaud found teachers’ SSNs were accessible in the HTML source code of some Missouri education department webpages.</p>
<p>After confirming that state IT officials had secured the exposed teacher data, the Post-Dispatch <a href="https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agencys-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html" target="_blank" rel="noopener">ran a story about their findings</a>. Gov. Parson responded by holding a press conference in which he vowed his administration would seek to prosecute and investigate &#8220;the hackers” and anyone who aided the publication in its “attempt to embarrass the state and sell headlines for their news outlet.”</p>
<p>&#8220;The state is committed to bringing to justice anyone who hacked our systems or anyone who aided them to do so,&#8221; Parson said in October. &#8220;A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert or decode, so this was clearly a hack.&#8221;</p>
<p>Parson tasked the Missouri Highway Patrol to produce a report on their investigation into &#8220;the hackers.&#8221;  On Monday, Feb. 21, The Post-Dispatch published <a href="media/0365d257.redacted-information-for-sunshine-request.pdf" data-original-source="https://s3.documentcloud.org/documents/21271820/redacted-information-for-sunshine-request.pdf" target="_blank" rel="noopener">the 158-page report</a> (PDF), which concluded after 175 hours of investigation that Renaud did nothing wrong and only accessed information that was publicly available.</p>
<p>Emails later obtained by the Post-Dispatch showed that the FBI told state cybersecurity officials that there was &#8220;not an actual network intrusion&#8221; and the state database was &#8220;misconfigured.&#8221; The emails also revealed the proposed message when education department leaders initially prepared to respond in October:</p>
<p>“We are grateful to the member of the media who brought this to the state’s attention,&#8221; was the proposed quote attributed to the state&#8217;s education commissioner before Parson began shooting the messenger.<span id="more-58607"></span></p>
<p>The Missouri Highway Patrol report includes an interview with <strong>Mallory McGowin</strong>, the chief communications officer for the state&#8217;s Department of Elementary and Secondary Education (DESE). McGowin told police the website weakness actually exposed 576,000 teacher Social Security numbers, and the data would have been publicly exposed for a decade.</p>
<p>McGowin also said the DESE&#8217;s website was developed and maintained by the Office of Administration&#8217;s <strong>Information Technology Services Division</strong> (ITSD) &#8212; which the governor&#8217;s office controls directly.</p>
<p>&#8220;I asked Mrs. McGowin if I was correct in saying the website was for DESE but it was maintained by ITSD, and she indicated that was correct,&#8221; the Highway Patrol investigator wrote. &#8220;I asked her if the ITSD was within the Office of Administration, or if DESE had their on-information technology section, and she indicated it was within the Office of Administration. She stated in 2009, policy was changed to move all information technology services to the Office of Administration.&#8221;</p>
<p>The report was a vindication for Renaud and for University of Missouri-St. Louis professor <strong>Shaji Khan</strong>, who helped the Post-Dispatch verify that the security flaw existed. Khan was also a target of Parson&#8217;s vow to prosecute &#8220;the hackers.&#8221; Khan&#8217;s attorney <strong>Elad Gross</strong> told the publication his client was not being charged, and that &#8220;state officials committed all of the wrongdoing here.&#8221;</p>
<p>&#8220;They failed to follow basic security procedures for years, failed to protect teachers&#8217; Social Security numbers, and failed to take responsibility, instead choosing to instigate a baseless investigation into two Missourians who did the right thing and reported the problem,&#8221; Gross told The Post-Dispatch. &#8220;We thank the Missouri State Highway Patrol and the Cole County Prosecutor&#8217;s Office for their diligent work on a case that never should have been sent to them.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58627
title: IRS: Selfies Now Optional, Biometric Data to Be Deleted
uri: IRS-Selfies-Now-Optional-Biometric-Data-to-Be-Deleted
url: https://krebsonsecurity.com/2022/02/irs-selfies-now-optional-biometric-data-to-be-deleted/
content:
<p><img loading="lazy" class="alignright wp-image-34053" src="media/e8972bf3.irsbldg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg.png" alt="" width="249" height="317" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg.png 666w, https://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png 580w" sizes="(max-width: 249px) 100vw, 249px" /></p>
<p>The<strong> U.S. Internal Revenue Service</strong> (IRS) said Monday that taxpayers are no longer required to provide facial scans to create an account online at irs.gov. In lieu of providing biometric data, taxpayers can now opt for a live video interview with <strong>ID.me</strong>, the privately-held Virginia company that runs the agency&#8217;s identity proofing system. The IRS also said any biometric data already shared with ID.me would be permanently deleted over the next few weeks, and any biometric data provided for new signups will be destroyed after an account is created.</p>
<p>&#8220;Taxpayers will have the option of verifying their identity during a live, virtual interview with agents; no biometric data – including facial recognition – will be required if taxpayers choose to authenticate their identity through a virtual interview,&#8221; the IRS said in <a href="https://www.irs.gov/newsroom/irs-statement-new-features-put-in-place-for-irs-online-account-registration-process-strengthened-to-ensure-privacy-and-security" target="_blank" rel="noopener">a Feb. 21 statement</a>.</p>
<p>&#8220;Taxpayers will still have the option to verify their identity automatically through the use of biometric verification through ID.me’s self-assistance tool if they choose,&#8221; the IRS explained. &#8220;For taxpayers who select this option, new requirements are in place to ensure images provided by taxpayers are deleted for the account being created. Any existing biometric data from taxpayers who previously created an IRS Online Account that has already been collected will also be permanently deleted over the course of the next few weeks.&#8221;</p>
<p>In addition, the IRS said it planned to roll out <strong>Login.gov</strong> as an authentication tool for those seeking access to their tax records online. Login.gov is a single sign-on solution already used to access 200 websites run by 28 federal agencies.</p>
<p>&#8220;The General Services Administration is currently working with the IRS to achieve the security standards and scale required of Login.Gov, with the goal of moving toward introducing this option after the 2022 filing deadline,&#8221; the agency wrote.<span id="more-58627"></span></p>
<p>The IRS first announced its partnership with ID.me in November, but the press release received little public attention. On Jan. 19, KrebsOnSecurity published the story <a href="https://krebsonsecurity.com/2022/01/irs-will-soon-require-selfies-for-online-access/" target="_blank" rel="noopener">IRS Will Soon Require Selfies for Online Access</a>, detailing a rocky experience signing up for IRS access via ID.me.</p>
<div id="attachment_58161" style="width: 768px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58161" loading="lazy" class=" wp-image-58161" src="media/15092662.irs-idme.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme.png" alt="" width="758" height="559" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme.png 1175w, https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme-768x566.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/irs-idme-782x576.png 782w" sizes="(max-width: 758px) 100vw, 758px" /><p id="caption-attachment-58161" class="wp-caption-text">The IRS says it will require ID.me for all logins later this summer.</p></div>
<p>That story went viral, and the ensuing media coverage forced the IRS to answer questions about why it was incentivizing the collection and storage of biometric data by a private company. On Feb. 7, the IRS announced its intention to <a href="https://krebsonsecurity.com/2022/02/irs-to-ditch-biometric-requirement-for-online-access/comment-page-1/" target="_blank" rel="noopener">transition away from requiring biometric data</a> from taxpayers who wish to access their records at the agency&#8217;s website, but it left unanswered the question of what would happen with the facial recognition data already collected by ID.me on behalf of the IRS.</p>
<p>In a letter to the IRS this month, <strong>Senate Finance Committee Chairman Ron Wyden</strong> (D-Ore.) challenged the Treasury Department and IRS to reconsider the biometric requirements, saying login.gov is perfectly up to the task if given all of the resources and funding it deserves.</p>
<p>&#8220;Unfortunately, login.gov has not yet reached its full potential, in part because many agencies have flouted the Congressional mandate that they use it, and because successive Administrations have failed to prioritize digital identity,&#8221; Wyden wrote. &#8220;The cost of this inaction has been billions of dollars in fraud, which has in turn fueled a black market for stolen personal data, and enabled companies like ID.me to commercialize what should be a core government service.”</p>


feed_id: https://krebsonsecurity.com/?p=58650
title: Russia Sanctions May Spark Escalating Cyber Conflict
uri: Russia-Sanctions-May-Spark-Escalating-Cyber-Conflict
url: https://krebsonsecurity.com/2022/02/russia-sanctions-may-spark-escalating-cyber-conflict/
content:
<p><img loading="lazy" class="aligncenter size-full wp-image-58662" src="media/ea27af60.sanctionsru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/sanctionsru.png" alt="" width="749" height="497" /></p>
<p><strong>President Biden</strong> joined European leaders this week in enacting economic sanctions against Russia in response its military invasion of Ukraine. The West has promised tougher sanctions are coming, but experts warn these will almost certainly trigger a Russian retaliation against America and its allies, which could escalate into cyber attacks on Western financial institutions and energy infrastructure.</p>
<p><strong>Michael Daniel</strong> is a former cybersecurity advisor to the White House during the Obama administration who now heads the <a href="https://www.cyberthreatalliance.org" target="_blank" rel="noopener">Cyber Threat Alliance</a>, an industry group focused on sharing threat intelligence among members. Daniel said there are two primary types of cyber threats the group is concerned about potentially coming in response to sanctions on Russia.</p>
<p>The first involves what Daniel called &#8220;spillover and collateral damage&#8221; &#8212; a global malware contagion akin to a <a href="https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/" target="_blank" rel="noopener">NotPeyta event</a> &#8212; basically some type of cyber weapon that has self-propagating capabilities and may even leverage a previously unknown security flaw in a widely-used piece of hardware or software.</p>
<p>Russia has been suspected of releasing <a href="https://en.wikipedia.org/wiki/Petya_(malware)" target="_blank" rel="noopener">NotPetya</a>, a large-scale cyberattack in 2017 initially aimed at Ukrainian businesses that mushroomed into an extremely disruptive and expensive global malware outbreak.</p>
<p>&#8220;The second level [is that] in retaliation for sanctions or perceived interference, Russia steps up more direct attacks on Western organizations,&#8221; Daniel said. &#8220;The Russians have shown themselves to be incredibly ingenious and creative in terms of how they come up with targets that seem to catch us by surprise. If the situation escalates in cyberspace, there could be some unanticipated organizations that end up in the crosshairs.&#8221;</p>
<p>What kinds of attacks are experts most concerned about? In part because the Russian economy is so dependent on energy exports, Russia has invested heavily in probing for weaknesses in the cyber systems that support bulk power production and distribution.</p>
<p>Ukraine has long been used as the testing grounds for Russian offensive hacking capabilities targeting power infrastructure. State-backed Russian hackers have been blamed for <a href="https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/" target="_blank" rel="noopener">the Dec. 23, 2015 cyberattack on Ukraine’s power grid</a> that left 230,000 customers shivering in the dark.</p>
<p>Experts warn that Russia could just as easily use its arsenal of sneaky cyber exploits against energy systems that support U.S. and European nations. In 2014, then <strong>National Security Agency Director Mike Roger</strong>s <a href="https://www.bloomberg.com/news/articles/2014-11-20/foreign-governments-have-hacked-u-s-power-system-nsa-head-says" target="_blank" rel="noopener">told lawmakers</a> that hackers had been breaking into U.S. power utilities to probe for weaknesses, and that Russia had been caught planting malware in the same kind of industrial computers used by power utilities.</p>
<p>&#8220;All of that leads me to believe it is only a matter of when, not if, we are going to see something dramatic,&#8221; Rogers said at the time.</p>
<p>That haunting prophecy is ringing anew as European leaders work on hammering out additional sanctions, which the European Commission president says will restrict the Russian economy’s ability to function by starving it of important technology and access to finance.</p>
<p>A draft of the new penalties obtained by <em>The New York Times</em> would see the European Union ban the export of aircraft and spare parts that are necessary for the maintenance of Russian fleets.</p>
<p>&#8220;The bloc will also ban the export of specialized oil-refining technology as well as semiconductors, and it will penalize more banks — although it will stop short of targeting VTB, Russia’s second-largest bank, which is already crippled by American and British sanctions,&#8221; The Times <a href="https://www.nytimes.com/2022/02/25/world/europe/eu-russian-sanctions.html" target="_blank" rel="noopener">wrote</a>.</p>
<p><strong>Dmitri Alperovitch</strong> is co-founder and former chief technology officer at the security firm <strong>CrowdStrike</strong>. Writing for <em>The Economist</em>, Alperovitch said America must tailor its response carefully to avoid initiating a pattern of escalation that could result in a potentially devastating hot war with Russia.</p>
<p>&#8220;The proposed combination of sanctions on top Russian banks and implementation of export controls on semiconductors would be likely to severely debilitate the Russian economy,&#8221; Alperovitch <a href="https://www.economist.com/by-invitation/2022/02/23/dmitri-alperovitch-on-the-risks-of-escalation" target="_blank" rel="noopener">wrote</a>. &#8220;And although many in the West may initially cheer this outcome as righteous punishment for Russia’s blatant violation of Ukrainian sovereignty, these measures will probably trigger significant Russian retaliation against America. That prospect all but guarantees that the conflict will not come to an end with an invasion of Ukraine.&#8221;</p>
<p>Faced with a potentially existential threat to its economic well-being &#8212; and seeing itself as having nothing more to lose &#8212; Russia will have several tools at its disposal with which to respond, he said: One of those will be carrying out cyber-attacks against American and European financial institutions and energy infrastructure.</p>
<p>&#8220;Having already exhausted the power of economic sanctions, America and its European allies would have few choices other than to respond to these attacks with offensive cyber-strikes of their own,&#8221; Alperovitch wrote. &#8220;This pattern of tit-for-tat cyber retaliation could place Russia and the West on a worrying path. It could end with the conflict spilling out of cyberspace and into the realm of a hot conflict. This outcome—a hot conflict between two nuclear powers with extensive cyber capabilities—is one that everyone in the world should be anxious to avoid.&#8221;</p>
<p>In May 2021, Russian cybercriminals unleashed <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">a ransomware attack against Colonial Pipeline</a>, a major fuel distributor in the United States. The resulting outage caused fuel shortages and price spikes across the nation. Alperovitch says a retaliation from Russia in response to sanctions could make the Colonial Pipeline attack seem paltry by comparison.</p>
<p><span class="pullquote pqright">&#8220;The colonial pipeline is going to be like child’s play if the Russians truly unleash all their capability,&#8221; Alperovitch told <strong>CNBC</strong> this week.</span></p>
<p>For example, having your organization&#8217;s computers and servers locked by ransomware may seem like a day at the park compared to getting hit with &#8220;wiper&#8221; malware that simply overwrites or corrupts data on infected systems.</p>
<p><strong>Kim Zetter</strong>, a veteran <em>Wired</em> reporter who now runs her own <a href="https://zetter.substack.com/subscribe?token=eyJ1c2VyX2lkIjo2MjA1MTc2LCJpYXQiOjE2NDU2NzI5NzMsImV4cCI6MTY0ODI2NDk3MywiaXNzIjoicHViLTMxMjIzOCIsInN1YiI6ImNoZWNrb3V0In0.fcp7zXm8HwsBNdT_kWWfeCm5ENY8ohSngIpBwCyY2q4&amp;utm_medium=email&amp;utm_source=subscribe-widget&amp;utm_content=49258393" target="_blank" rel="noopener">cybersecurity-focused Substack newsletter</a>, has painstakingly documented two separate wiper attacks launched in the lead-up to the Russian invasion that targeted Ukrainian government and contractor networks, as well as systems in Latvia and Lithuania.</p>
<p>One contractor interviewed by Zetter said the wiper attacks appeared to be extremely targeted, going after organizations that support the Ukrainian government &#8212; regardless of where those organizations are physically located.<span id="more-58650"></span></p>
<p>&#8220;The wiper, dubbed HermeticaWiper, appears to have been in the works for months but was only released on computers today,&#8221; Zetter wrote. &#8220;It follows on a previous wiper attack that struck Ukrainian systems in January called WhisperGate. Like that previous infection, HermeticaWiper is designed to overwrite files on systems to render them inoperable.&#8221;</p>
<p>A <a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-047a" target="_blank" rel="noopener">joint advisory</a> last week by the <strong>FBI</strong>, <strong>National Security Agency</strong> (NSA) and the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) <a href="media/a8abfc71.CSA_STOP-MCA-AGAINST-OT_UOO13672321.PDF" data-original-source="https://media.defense.gov/2021/Apr/29/2002630479/-1/-1/0/CSA_STOP-MCA-AGAINST-OT_UOO13672321.PDF" target="_blank" rel="noopener">warned</a> that Russian cyber actors have been targeting cleared defense contractors, and that since January 2020 and continuing through this month, the cyber actors had maintained a persistent presence on those contractor networks. The advisory said the attackers exfiltrated email and data, and were able to &#8220;acquire sensitive, unclassified information, as well as proprietary and export-controlled technology.&#8221;</p>
<p>A <a href="https://www.nbcnews.com/politics/national-security/biden-presented-options-massive-cyberattacks-russia-rcna17558" target="_blank" rel="noopener">report Thursday by NBC News</a> suggested President Biden had been presented with options for massive cyberattacks against Russia, including the disruption of Internet access across Russia, shutting off the power, and stopping trains in their tracks.</p>
<p>But White House National Security Council spokesperson <strong>Emily Home</strong> <a href="https://www.reuters.com/world/europe/biden-presented-with-options-cyberattacks-against-russia-nbc-news-2022-02-24/" target="_blank" rel="noopener">told Reuters</a> the NBC News report was &#8220;wildly off base and does not reflect what is actually being discussed in any shape or form.&#8221;</p>
<p>That&#8217;s good news, according to <strong>Jim Lewis</strong>, director of the public policy program at the <strong>Center for Strategic and International Studies</strong>. Lewis said the United States and its allies have far more to lose if the West gets embroiled in an escalation of cyber attacks with Russia over sanctions.</p>
<p>&#8220;The asymmetry in pressure points makes the idea of us doing something probably not a good idea,&#8221; Lewis told KrebsOnSecurity. &#8220;If Putin hasn&#8217;t gone completely nuts, he&#8217;ll be cautious of doing anything that might be construed under international law as the use of force through cyber means.&#8221;</p>
<p>Lewis said a more likely response from Russia would include enlisting cybercriminals throughout Russia and the Commonwealth of Independent States to step up ransomware and other disruptive attacks against high-impact targets in specific industries.</p>
<p>&#8220;The pressure points for Putin are his political support &#8212; the oligarchs and security services,&#8221; Lewis said. &#8220;If we want to squeeze him, that&#8217;s where we have to squeeze, things like seizing all their real estate in Miami Beach, or putting them on no-fly lists. If you want to hurt Putin, a cyberattack probably wouldn&#8217;t do it. Unless it was against his bank account.&#8221;</p>
<p>In a call to action issued earlier this week dubbed &#8220;<a href="https://www.cisa.gov/shields-up" target="_blank" rel="noopener">Shields Up</a>,&#8221; CISA warned that Russia could escalate its destabilizing actions in ways that may impact others outside of Ukraine. CISA also published a new catalog of <a href="https://www.cisa.gov/news/2022/02/18/cisa-launches-new-catalog-free-public-and-private-sector-cybersecurity-services" target="_blank" rel="noopener">free public and private sector cybersecurity services</a>.</p>


feed_id: https://krebsonsecurity.com/?p=58685
title: Conti Ransomware Group Diaries, Part I: Evasion
uri: Conti-Ransomware-Group-Diaries-Part-I-Evasion
url: https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/
content:
<p>A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to <strong>Conti</strong>, an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million in annual revenue. The chat logs offer a fascinating glimpse into the challenges of running a sprawling criminal enterprise with more than 100 salaried employees. The records also provide insight into how Conti has dealt with its own internal breaches and attacks from private security firms and foreign governments.</p>
<div id="attachment_58693" style="width: 651px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58693" loading="lazy" class="size-full wp-image-58693" src="media/213774ba.conti-ukraine.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/conti-ukraine.png" alt="" width="641" height="637" /><p id="caption-attachment-58693" class="wp-caption-text">Conti&#8217;s threatening message this week regarding international interference in Ukraine.</p></div>
<p>Conti makes international news headlines each week when it publishes to its dark web blog new information stolen from ransomware victims who refuse to pay an extortion demand. In response to Russia&#8217;s invasion of Ukraine, Conti <a href="https://www.reuters.com/technology/russia-based-ransomware-group-conti-issues-warning-kremlin-foes-2022-02-25/" target="_blank" rel="noopener">published a statement</a> announcing its &#8220;full support.&#8221;</p>
<p>&#8220;If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use all our possible resources to strike back at the critical infrastructures of an enemy,&#8221; the Conti blog post read.</p>
<p>On Sunday, Feb. 27, a new Twitter account &#8220;<a href="https://twitter.com/contileaks" target="_blank" rel="noopener">Contileaks</a>&#8221; posted links to an archive of chat messages taken from Conti&#8217;s private communications infrastructure, dating from January 29, 2021 to the present day. Shouting &#8220;Glory for Ukraine,&#8221; the Contileaks account has since published additional Conti employee conversations from June 22, 2020 to Nov. 16, 2020.</p>
<p>The Contileaks account did not respond to requests for comment. But <strong>Alex Holden</strong>, the Ukrainian-born founder of the Milwaukee-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, said the person who leaked the information is not a former Conti affiliate &#8212; as many on Twitter have assumed. Rather, he said, the leaker is a Ukrainian security researcher who has chosen to stay in his country and fight.</p>
<p>&#8220;The person releasing this is a Ukrainian and a patriot,&#8221; Holden said. &#8220;He&#8217;s seeing that Conti is supporting Russia in its invasion of Ukraine, and this is his way to stop them in his mind at least.&#8221;</p>
<h2>GAP #1</h2>
<p>The temporal gaps in these chat records roughly correspond to times when Conti&#8217;s IT infrastructure was dismantled and/or infiltrated by security researchers, private companies, law enforcement, and national intelligence agencies. The holes in the chat logs also match up with periods of relative quiescence from the group, as it sought to re-establish its network of infected systems and dismiss its low-level staff as a security precaution.</p>
<p>On Sept. 22, 2020, the <strong>U.S. National Security Agency</strong> (NSA) began <a href="https://krebsonsecurity.com/2020/10/report-u-s-cyber-command-behind-trickbot-tricks/" target="_blank" rel="noopener">a weeks-long operation</a> in which it seized control over the <strong>Trickbot botnet</strong>, a malware crime machine that has infected millions of computers and is often used to spread ransomware. Conti is one of several cybercrime groups that has regularly used Trickbot to deploy malware.</p>
<p>Once in control over Trickbot, the NSA&#8217;s hackers sent all infected systems a command telling them to disconnect themselves from the Internet servers the Trickbot overlords used to control compromised <strong>Microsoft Windows</strong> computers. On top of that, the NSA <a href="https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/" target="_blank" rel="noopener">stuffed millions of bogus records about new victims into the Trickbot database</a>.</p>
<p>News of the Trickbot compromise was <a href="https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/" target="_blank" rel="noopener">first published here on Oct. 2, 2020</a>, but the leaked Conti chats show that the group&#8217;s core leadership detected something was seriously wrong with their crime machine just a few hours after the initial compromise of Trickbot&#8217;s infrastructure on Sept. 22.</p>
<p>&#8220;The one who made this garbage did it very well,&#8221; wrote &#8220;<strong>Hof</strong>,&#8221; the handle chosen by a top Conti leader, commenting on the Trickbot malware implant that was supplied by the NSA and quickly spread to the rest of the botnet. &#8220;He knew how the bot works, i.e. he probably saw the source code, or reversed it. Plus, he somehow encrypted the config, i.e. he had an encoder and a private key, plus uploaded it all to the admin panel. It&#8217;s just some kind of sabotage.&#8221;</p>
<p>&#8220;Moreover, the bots have been flooded with such a config that they will simply work idle,&#8221; Hof explained to his team on Sept. 23, 2020. Hof noted that the intruder even kneecapped Trickbot&#8217;s built-in failsafe recovery mechanism. Trickbot was configured so that if none of the botnet&#8217;s control servers were reachable, the bots could still be recaptured and controlled by registering a pre-computed domain name on <strong>EmerDNS</strong>, a decentralized domain name system based on the <strong>Emercoin</strong> virtual currency.</p>
<p>&#8220;After a while they will download a new config via emercoin, but they will not be able to apply this config, because this saboteur has uploaded the config with the maximum number, and the bot is checking that the new config should be larger than the old one,&#8221; Hof wrote. &#8220;Sorry, but this is fucked up. I don&#8217;t know how to get them back.&#8221;</p>
<p>It would take the Conti gang several weeks to rebuild its malware infrastructure, and infect tens of thousands of new Microsoft Windows systems. By late October 2020, Conti&#8217;s network of infected systems had grown to include 428 medical facilities throughout the United States. The gang&#8217;s leaders saw an opportunity to create widespread panic &#8212; if not also chaos &#8212; by deploying their ransomware simultaneously to hundreds of American healthcare organizations already struggling amid a worldwide pandemic.</p>
<p>&#8220;Fuck the clinics in the USA this week,&#8221; wrote Conti manager &#8220;Target&#8221; on Oct. 26, 2020. &#8220;There will be panic. 428 hospitals.&#8221;</p>
<p>On October 28, the <strong>FBI</strong> and the <strong>U.S. Department of Homeland Security</strong> hastily assembled a conference call with healthcare industry executives warning about an “<a href="https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/" rel="noopener" target="_blank">imminent cybercrime threat to U.S. hospitals and healthcare providers</a>.”</p>
<p>Follow-up reporting confirmed that at least a dozen healthcare organizations were hit with ransomware that week, but the carnage apparently was not much worse than a typical week in the healthcare sector. One information security leader in the healthcare industry told KrebsOnSecurity at the time that it wasn&#8217;t uncommon for the industry to see at least one hospital or health care facility hit with ransomware each day.<span id="more-58685"></span></p>
<h2>GAP #2</h2>
<p>The more recent gap in the Conti chat logs corresponds to <a href="https://krebsonsecurity.com/2021/01/international-action-targets-emotet-crimeware/" target="_blank" rel="noopener">a Jan. 26, 2021 international law enforcement operation to seize control of <strong>Emotet</strong></a>, a prolific malware strain and cybercrime-as-a-service platform that was used heavily by Conti. Following the Emotet takedown, the Conti group once again reorganized, with everyone forced to pick new nicknames and passwords.</p>
<p>The logs show Conti made a special effort to help one of its older members &#8212; <strong>All Witte</strong> &#8212; a 55-year-old Latvian woman <a href="https://krebsonsecurity.com/2021/06/how-does-one-get-hired-by-a-top-cybercrime-gang/" target="_blank" rel="noopener">arrested last year on suspicion of working as a programmer for the Trickbot group</a>. The chat records indicate Witte became something of a maternal figure for many of Conti&#8217;s younger personnel, and after her arrest Conti&#8217;s leadership began scheming a way to pay for her legal defense.</p>
<div id="attachment_55940" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55940" loading="lazy" class=" wp-image-55940" src="media/4b8ebf3e.allawitte.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte.png" alt="" width="753" height="393" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte.png 1390w, https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte-768x401.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte-782x408.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte-267x140.png 267w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-55940" class="wp-caption-text">Alla Witte&#8217;s personal website &#8212; allawitte[.]nl &#8212; circa October 2018.</p></div>
<p>&#8220;They gave me a lawyer, they said the best one, plus excellent connections, he knows the investigator, he knows the judge, he is a federal lawyer there, licensed, etc., etc.,&#8221; wrote <strong>Mango</strong>&#8221; &#8212; a mid-level manager within Conti &#8212; to &#8220;Stern,&#8221; a much higher-up Conti manager and taskmaster who frequently asked various units of the gang for updates on their daily assignments.</p>
<p>Stern agreed that this was the best course of action, but it&#8217;s unclear if it was successfully carried out. Also, the entire scheme may not have been as altruistic as it seemed: Mango suggested that paying Witte&#8217;s attorney fees might also give the group inside access to information about the government&#8217;s ongoing investigation of Trickbot.</p>
<p>&#8220;Let&#8217;s try to find a way to her lawyer right now and offer him to directly sell the data bypassing her,&#8221; Mango suggests to Stern on June 23, 2021.</p>
<p>The FBI has been investigating Trickbot for years, and it is clear that at some point the U.S. government shared information with the Russians about the hackers they suspected were behind Trickbot. It is also clear from reading these logs that the Russians did little with this information until October 2021, when Conti&#8217;s top generals began receiving tips from their Russian law enforcement sources that the investigation was being rekindled.</p>
<p>&#8220;Our old case was resumed,&#8221; wrote the Conti member &#8220;<strong>Kagas</strong>&#8221; in a message to Stern on Oct. 6, 2021. &#8220;The investigator said why it was resumed: The Americans officially requested information about Russian hackers, not only about us, but in general who was caught around the country. Actually, they are interested in the Trickbot, and some other viruses. Next Tuesday, the investigator called us for a conversation, but for now, it&#8217;s like [we&#8217;re being called on as] witnesses. That way if the case is suspended, they can&#8217;t interrogate us in any way, and, in fact, because of this, they resumed it. We have already contacted our lawyers.&#8221;</p>
<p>Incredibly, another Conti member pipes into the discussion and says the group has been assured that the investigation will go nowhere from the Russian side, and that the entire inquiry from local investigators would be closed by mid-November 2021.</p>
<p>It appears Russian investigators were more interested in going after a top Conti competitor &#8212; <strong>REvil</strong>, an equally ruthless Russian ransomware group that likewise mainly targeted large organizations that could pay large ransom demands.</p>
<p>On Jan. 14, 2022, the Russian government <a href="https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/" target="_blank" rel="noopener">announced the arrest of 14 people accused of working for REvil</a>. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown was part of a cynical ploy to assuage (or distract) public concerns over Russian President Vladimir Putin&#8217;s bellicose actions in the weeks before his invasion of Ukraine.</p>
<p>The leaked Conti messages show that TrickBot was effectively shut down earlier this month. As <strong>Catalin Cimpanu</strong> at <a href="https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/" rel="noopener" target="_blank">The Record points out</a>, the messages also contain copious ransom negotiations and payments from companies that had not disclosed a breach or ransomware incident (and indeed had paid Conti to ensure their silence). In addition, there are hundreds of bitcoin addresses in these chats that will no doubt prove useful to law enforcement organizations seeking to track the group&#8217;s profits.</p>
<p>This is the first of several stories about the inner workings of Conti, based on the leaked chat records. Part II will be told through the private messages exchanged by Conti employees working in different operational units, and it explores some of the more unique and persistent challenges facing large-scale cybercriminal organizations today.</p>


feed_id: https://krebsonsecurity.com/?p=58690
title: Conti Ransomware Group Diaries, Part II: The Office
uri: Conti-Ransomware-Group-Diaries-Part-II-The-Office
url: https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/
content:
<p>Earlier this week, a Ukrainian security researcher leaked almost two years&#8217; worth of internal chat logs from <strong>Conti</strong>, one of the more rapacious and ruthless ransomware gangs in operation today. <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">Tuesday&#8217;s story</a> examined how Conti dealt with its own internal breaches and attacks from private security firms and governments. In Part II of this series we&#8217;ll explore what it&#8217;s like to work for Conti, as described by the Conti employees themselves.</p>
<p><img loading="lazy" class="aligncenter wp-image-58726" src="media/79f0cc77.conti.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/conti.png" alt="" width="759" height="374" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/conti.png 806w, https://krebsonsecurity.com/wp-content/uploads/2022/03/conti-768x378.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/conti-782x385.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></p>
<p>The Conti group&#8217;s chats reveal a great deal about the internal structure and hierarchy of the ransomware organization. Conti maintains many of the same business units as a legitimate, small- to medium-sized enterprise, including a Human Resources department that is in charge of constantly interviewing potential new hires.</p>
<p>Other Conti departments with their own distinct budgets, staff schedules, and senior leadership include:</p>
<p>&#8211;<strong>Coders:</strong> Programmers hired to write malicious code, integrate disparate technologies<br />
&#8211;<strong>Testers:</strong> Workers in charge of testing Conti malware against security tools and obfuscating it<br />
&#8211;<strong>Administrators:</strong> Workers tasked with setting up, tearing down servers, other attack infrastructure<br />
&#8211;<strong>Reverse Engineers:</strong> Those who can disassemble computer code, study it, find vulnerabilities or weaknesses<br />
&#8211;<strong>Penetration Testers/Hackers:</strong> Those on the front lines battling against corporate security teams to steal data, and plant ransomware.</p>
<p>Conti appears to have contracted out much of its spamming operations, or at least there was no mention of &#8220;Spammers&#8221; as direct employees. Conti&#8217;s leaders seem to have set strict budgets for each of its organizational units, although it occasionally borrowed funds allocated for one department to address the pressing cashflow needs of another.</p>
<p>A great many of the more revealing chats concerning Conti&#8217;s structure are between &#8220;<strong>Mango</strong>&#8221; &#8212; a mid-level Conti manager to whom many other Conti employees report each day &#8212; and &#8220;<strong>Stern</strong>,&#8221; a sort of cantankerous taskmaster who can be seen constantly needling the staff for reports on their work.</p>
<p>In July 2021, Mango told Stern that the group was placing ads on several Russian-language cybercrime forums to hire more workers. &#8220;The salary is $2k in the announcement, but there are a lot of comments that we are recruiting galley slaves,&#8221; Mango wrote. &#8220;Of course, we dispute that and say those who work and bring results can earn more, but there are examples of coders who work normally and earn $5-$10k salary.&#8221;</p>
<p>The Conti chats show the gang primarily kept tabs on the victim bots infected with their malware via both the <strong>Trickbot</strong> and <strong>Emotet</strong> crimeware-as-a-service platforms, and that it employed dozens of people to continuously test, maintain and expand this infrastructure 24 hours a day, 7 days a week.</p>
<p>Conti members referred to Emotet as &#8220;<strong>Booz</strong>&#8221; or &#8220;<strong>Buza</strong>,&#8221; and it is evident from reading these chat logs that Buza had its own stable of more than 50 coders, and likely much of the same organizational structure as Conti.</p>
<p>According to Mango, as of July 18, 2021 the Conti gang employed 62 people, mostly low-level malware coders and software testers. However, Conti&#8217;s employee roster appears to have fluctuated wildly from one month to the next. For example, on multiple occasions the organization was forced to fire many employees as a security precaution in the wake of its own internal security breaches.</p>
<p>In May 2021, Stern told Mango he wanted his underlings to hire 100 more &#8220;encoders&#8221; to work with the group&#8217;s malware before the bulk of the gang returns from their summer vacations in Crimea. Most of these new hires, Stern says, will join the penetration testing/hacking teams headed by Conti leaders &#8220;<strong>Hof</strong>&#8221; and &#8220;<strong>Reverse</strong>.&#8221; Both Hof and Reverse appear to have direct access to the Emotet crimeware platform.</p>
<p>Trying to accurately gauge the size of the Conti organization is problematic, in part because cybersecurity experts have long held that Conti is merely a rebrand of another ransomware strain and affiliate program known as <a href="https://en.wikipedia.org/wiki/Ryuk_(ransomware)" target="_blank" rel="noopener">Ryuk</a>. First spotted in 2018, Ryuk was just as ruthless and mercenary as Conti, and the FBI says that in first year of its operation Ryuk earned more than $61 million in ransom payouts.</p>
<p>&#8220;Conti is a Targeted version of Ryuk, which comes from Trickbot and Emotet which we&#8217;ve been monitoring for some time,&#8221; researchers at <a href="https://www.paloaltonetworks.com/blog/security-operations/conti-or-so-i-am-told/" target="_blank" rel="noopener">Palo Alto Networks wrote about Ryuk last year</a>. &#8220;A heavy focus was put on hospital systems, likely due to the necessity for uptime, as these systems were overwhelmed with handling the ongoing COVID-19 pandemic. We observed initial Ryuk ransom requests ranging from US$600,000 to $10 million across multiple industries.&#8221;</p>
<p>On May 14, 2021, Ireland&#8217;s <strong>Health Service Executive</strong> (HSE) <a href="https://krebsonsecurity.com/2021/12/inside-irelands-public-healthcare-ransomware-scare/" target="_blank" rel="noopener">suffered a major ransomware attack at the hands of Conti</a>. The attack would disrupt services at several Irish hospitals, and resulted in the near complete shutdown of the HSE&#8217;s national and local networks, forcing the cancellation of many outpatient clinics and healthcare services. It took the HSE until Sept. 21, 2021 to fully restore all of its systems from the attack, at at estimated cost of more than $600 million.</p>
<p>It remains unclear from reading these chats how many of Conti&#8217;s staff understood how much of the organization&#8217;s operations overlapped with that of Ryuk. <strong>Lawrence Abrams</strong> at <a href="https://www.bleepingcomputer.com" target="_blank" rel="noopener">Bleeping Computer</a> pointed to an October 2020 Conti chat in which the Emotet representative &#8220;Buza&#8221; posts a link to a security firm&#8217;s analysis of Ryuk&#8217;s return.</p>
<p><img loading="lazy" class="aligncenter  wp-image-58740" src="media/d7aac021.abramstweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/abramstweet.png" alt="" width="584" height="800" /></p>
<p>&#8220;<strong>Professor</strong>,&#8221; the nickname chosen by one of Conti&#8217;s most senior generals, replies that indeed Ryuk&#8217;s tools, techniques and procedures are nearly identical to Conti&#8217;s.</p>
<p>&#8220;adf.bat &#8212; this is my fucking batch file,&#8221; Professor writes, evidently surprised at having read the analysis and spotting his own code being re-used in high-profile ransomware attacks by Ryuk.</p>
<p>&#8220;Feels like [the] same managers were running both Ryuk and Conti, with a slow migration to Conti in June 2020,&#8221; Abrams <a href="https://twitter.com/LawrenceAbrams/status/1499046186942144523" target="_blank" rel="noopener">wrote on Twitter</a>. &#8220;However, based on chats, some affiliates didn&#8217;t know that Ryuk and Conti were run by the same people.&#8221;<span id="more-58690"></span></p>
<h2>ATTRITION</h2>
<p>Each Conti employee was assigned a specific 5-day workweek, and employee schedules were staggered so that some number of staff was always on hand 24/7 to address technical problems with the botnet, or to respond to ransom negotiations initiated by a victim organization.</p>
<p>Like countless other organizations, Conti made its payroll on the 1st and 15th of each month, albeit in the form of Bitcoin deposits. Most employees were paid $1,000 to $2,000 monthly.</p>
<p>However, many employees used the Conti chat room to vent about working days on end without sleep or breaks, while upper managers ignored their repeated requests for time off.</p>
<p>Indeed, the logs indicate that Conti struggled to maintain a steady number of programmers, testers and administrators in the face of mostly grueling and repetitive work that didn&#8217;t pay very well (particularly in relation to the earnings of the group&#8217;s top leadership). What&#8217;s more, some of the group&#8217;s top members were openly being approached to work for competing ransomware organizations, and the overall morale of the group seemed to fluctuate between paydays.</p>
<p>Perhaps unsurprisingly, the turnover, attrition and burnout rate was quite high for low-level Conti employees, meaning the group was forced to constantly recruit new talent.</p>
<p>&#8220;Our work is generally not difficult, but monotonous, doing the same thing every day,&#8221; wrote &#8220;<strong>Bentley</strong>,&#8221; the nickname chosen by the key Conti employee apparently in charge of &#8220;crypting&#8221; the group&#8217;s malware &#8212; ensuring that it goes undetected by all or at least most antivirus products on the market.</p>
<p>Bentley was addressing a new Conti hire &#8212; &#8220;<strong>Idgo</strong>&#8221; &#8212; telling him about his daily duties.</p>
<p>&#8220;Basically, this involves launching files and checking them according to the algorithm,&#8221; Bentley explains to Idgo. &#8220;Poll communication with the encoder to receive files and send reports to him. Also communication with the cryptor to send the tested assembly to the crypt. Then testing the crypt. If jambs appear at this stage , then sending reports to the cryptor and working with him. And as a result &#8211; the issuance of the finished crypt to the partner.&#8221;</p>
<p>Bentley cautioned that this testing of their malware had to be repeated approximately every four hours to ensure that any new malware detection capability added to Windows Defender &#8212; the built-in antivirus and security service in Windows &#8212; won&#8217;t interfere with their code.</p>
<p>&#8220;Approximately every 4 hours, a new update of Defender databases is released,&#8221; Bentley told Idgo. &#8220;You need to work for 8 hours before 20-21 Moscow time. And career advancement is possible.&#8221; Idgo agrees, noting that he&#8217;d started working for Conti a year earlier, as a code tester.</p>
<p><img loading="lazy" class="aligncenter wp-image-39684" src="media/aebffc40.computered.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/06/computered.png" alt="" width="766" height="513" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/06/computered.png 1551w, https://krebsonsecurity.com/wp-content/uploads/2017/06/computered-580x389.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/06/computered-768x514.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/06/computered-940x630.png 940w" sizes="(max-width: 766px) 100vw, 766px" /></p>
<h2>OBSERVATIONS</h2>
<p>The logs show the Conti gang is exceedingly good at quickly finding many potential new ransomware victims, and the records include many internal debates within Conti leadership over how much certain victim companies should be forced to pay. They also show with terrifying precision how adeptly a large, organized cybercrime group can pivot from a single compromised PC to completely owning a Fortune 500 company.</p>
<p>As a well-staffed &#8220;big game&#8221; killing machine, Conti is perhaps unparalleled among ransomware groups. But the internal chat logs show this group is in serious need of some workflow management and tracking tools. That&#8217;s because time and time again, the Conti gang lost control over countless bots &#8212; all potential sources of ransom revenue that will help pay employee salaries for months &#8212; because of a simple oversight or mistake.</p>
<p>Peppered throughout the leaked Conti chats &#8212; roughly several times each week &#8212; are pleadings from various personnel in charge of maintaining the sprawling and constantly changing digital assets that support the group&#8217;s ransomware operation. These messages invariably relate to past-due invoices for multiple virtual servers, domain registrations and other cloud-based resources.</p>
<p>On Mar. 1, 2021, a low-level Conti employee named &#8220;<strong>Carter</strong>&#8221; says the bitcoin fund used to pay for VPN subscriptions, antivirus product licenses, new servers and domain registrations is short $1,240 in Bitcoin.</p>
<p>&#8220;Hello, we&#8217;re out of bitcoins, four new servers, three vpn subscriptions and 22 renewals are out,&#8221; Carter wrote on Nov. 24, 2021. &#8220;Two weeks ahead of renewals for $960 in bitcoin 0.017. Please send some bitcoins to this wallet, thanks.&#8221;</p>
<p>As part of the research for this series, KrebsOnSecurity spent many hours reading each day of Conti&#8217;s chat logs going back to September 2020. I wish I could get many of those hours back: Much of the conversations are mind-numbingly boring chit-chat and shop talk. But overall, I came away with the impression that Conti is a highly effective &#8212; if also remarkably inefficient &#8212; cybercriminal organization.</p>
<p>Some of Conti&#8217;s disorganized nature is probably endemic in the cybercrime industry, which is of course made up of criminals who are likely accustomed to a less regimented lifestyle. But make no mistake: As ransomware collectives like Conti continue to increase payouts from victim organizations, there will be increasing pressure on these groups to tighten up their operations and work more efficiently, professionally and profitably.</p>
<p>Stay tuned for Part III in this series, which will look at how Conti secured access to the cyber weaponry needed to subvert the security of their targets, as well as how the team&#8217;s leaders approached ransom negotiations with their victims.</p>


feed_id: https://krebsonsecurity.com/?p=58724
title: Conti Ransomware Group Diaries, Part III: Weaponry
uri: Conti-Ransomware-Group-Diaries-Part-III-Weaponry
url: https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-iii-weaponry/
content:
<p>Part I of this series examined newly-leaked internal chats from the <strong>Conti</strong> ransomware group, and how the crime gang <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">dealt with its own internal breaches</a>. Part II explored what it&#8217;s like <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/" target="_blank" rel="noopener">to be an employee of Conti&#8217;s sprawling organization</a>. Today&#8217;s Part III looks at how Conti abused a panoply of popular commercial security services to undermine the security of their targets, as well as how the team’s leaders strategized for the upper hand in ransom negotiations with victims.</p>
<div id="attachment_58780" style="width: 769px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58780" loading="lazy" class=" wp-image-58780" src="media/fe5fad82.contistats.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats.png" alt="" width="759" height="386" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats.png 932w, https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats-768x391.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats-782x398.png 782w" sizes="(max-width: 759px) 100vw, 759px" /><p id="caption-attachment-58780" class="wp-caption-text">Conti is by far the most aggressive and profitable ransomware group in operation today. Image: Chainalysis</p></div>
<p>Conti is by far the most successful ransomware group in operation today, routinely pulling in multi-million dollar payments from victim organizations. That&#8217;s because more than perhaps any other ransomware outfit, Conti has chosen to focus its considerable staff and talents on targeting companies with more than $100 million in annual revenues.</p>
<p>As it happens, Conti itself recently joined the $100 million club. According to the latest <a href="media/b1a23a64.Crypto-Crime-Report-2022.pdf" data-original-source="https://go.chainalysis.com/rs/503-FAP-074/images/Crypto-Crime-Report-2022.pdf" target="_blank" rel="noopener">Crypto Crime Report</a> (PDF) published by virtual currency tracking firm <strong>Chainalysis</strong>, Conti generated at least $180 million in revenue last year.</p>
<p>On Feb. 27, a Ukrainian cybersecurity researcher who is currently in Ukraine leaked almost two years&#8217; worth of internal chat records from Conti, which had just posted a press release to its victim shaming blog saying it fully supported Russia&#8217;s invasion of his country. Conti warned it would use its cyber prowess to strike back at anyone who interfered in the conflict.</p>
<p>The leaked chats show that the Conti group &#8212; which fluctuated in size from 65 to more than 100 employees &#8212; budgeted several thousand dollars each month to pay for a slew of security and antivirus tools. Conti sought out these tools both for continuous testing (to see how many products detected their malware as bad), but also for their own internal security.</p>
<p>A chat between Conti upper manager &#8220;<strong>Reshaev</strong>&#8221; and subordinate &#8220;<strong>Pin</strong>&#8221; on Aug. 8, 2021 shows Reshaev ordering Pin to quietly check on the activity of the Conti network administrators once a week &#8212; to ensure they&#8217;re not doing anything to undermine the integrity or security of the group&#8217;s operation. Reshaev tells Pin to install endpoint detection and response (EDR) tools on every administrator&#8217;s computer.</p>
<p>&#8220;Check admins&#8217; activity on servers each week,&#8221; Reshaev said. &#8220;Install EDR on every computer (for example, Sentinel, Cylance, CrowdStrike); set up more complex storage system; protect LSAS dump on all computers; have only 1 active accounts; install latest security updates; install firewall on all network.&#8221;</p>
<p>Conti managers were hyper aware that their employees handled incredibly sensitive and invaluable data stolen from companies, information that would sell like hotcakes on the underground cybercrime forums. But in a company run by crooks, trust doesn&#8217;t come easily.</p>
<p>&#8220;You check on me all the time, don&#8217;t you trust me?,&#8221; asked mid-level Conti member &#8220;<strong>Bio</strong>&#8221; of &#8220;<strong>Tramp</strong>&#8221; (a.k.a. &#8220;<strong>Trump</strong>&#8220;), a top Conti overlord. Bio was handling a large bitcoin transfer from a victim ransom payment, and Bio detected that Trump was monitoring him.</p>
<p>&#8220;When that kind of money and people from the street come in who have never seen that kind of money, how can you trust them 1,000%?&#8221; Trump replied. &#8220;I&#8217;ve been working here for more than 15 years and haven&#8217;t seen anything else.&#8221;<span id="more-58724"></span></p>
<h2>OSINT</h2>
<p>Conti also budgeted heavily for what it called &#8220;OSINT,&#8221; or open-source intelligence tools. For example, it subscribed to numerous services that can help determine who or what is behind a specific Internet Protocol (IP) address, or whether a given IP is tied to a known virtual private networking (VPN) service. On an average day, Conti had access to tens of thousands of hacked PCs, and these services helped the gang focus solely on infected systems thought to be situated within large corporate networks.</p>
<p>Conti&#8217;s OSINT activities also involved abusing commercial services that could help the group gain the upper hand in ransom negotiations with victims. Conti often set its ransom demands as a percentage of a victim&#8217;s annual revenues, and the gang was known to harass board members of and investors in companies that refused to engage or negotiate.</p>
<p>In October 2021, Conti underling &#8220;<strong>Bloodrush</strong>&#8221; told his manager &#8220;<strong>Bentley</strong>&#8221; that the group urgently needed to purchase subscriptions to <strong>Crunchbase Pro</strong> and <strong>Zoominfo</strong>, noting that the services provide detailed information on millions of companies, such as how much insurance a company maintains; their latest earnings estimates; and contact information of executive officers and board members.</p>
<p>In a months-long project last year, Conti invested $60,000 in acquiring a valid license to <strong>Cobalt Strike</strong>, a commercial network penetration testing and reconnaissance tool that is sold only to vetted partners. But stolen or ill-gotten &#8220;Coba&#8221; licenses are frequently abused by cybercriminal gangs to help lay the groundwork for the installation of ransomware on a victim network. It appears $30,000 of that investment went to cover the actual cost of a Cobalt Strike license, while the other half was paid to a legitimate company that secretly purchased the license on Conti&#8217;s behalf.</p>
<p>Likewise, Conti&#8217;s Human Resources Department budgeted thousands of dollars each month toward employer subscriptions to numerous job-hunting websites, where Conti HR employees would sift through resumes for potential hires. In a note to Conti taskmaster &#8220;<strong>Stern</strong>&#8221; explaining the group&#8217;s paid access on one employment platform, Conti HR employee &#8220;<strong>Salamandra</strong>&#8221; says their workers have already viewed 25-30 percent of all relevant CVs available on the platform.</p>
<p>&#8220;About 25% of resumes will be free for you, as they are already opened by other managers of our company some CVs are already open for you, over time their number will be 30-35%,&#8221; Salamandra wrote. &#8220;Out of 10 CVs, approximately 3 will already be available.&#8221;</p>
<p>Another organizational unit within Conti with its own budget allocations &#8212; called the &#8220;<strong>Reversers</strong>&#8221; &#8212; was responsible for finding and exploiting new security vulnerabilities in widely used hardware, software and cloud-based services. On July 7, 2021, Stern ordered reverser &#8220;<strong>Kaktus</strong>&#8221; to start focusing the department&#8217;s attention on <strong>Windows 11</strong>, Microsoft&#8217;s newest operating system.</p>
<p>&#8220;Win11 is coming out soon, we should be ready for this and start studying it,&#8221; Stern said. &#8220;The beta is already online, you can officially download and work.&#8221;</p>
<h2>BY HOOK OR BY CROOK</h2>
<p>The chats from the Conti organization include numerous internal deliberations over how much different ransomware victims should be made to pay. And on this front, Conti appears to have sought assistance from multiple third parties.</p>
<p>Milwaukee-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> this week <a href="https://twitter.com/HoldSecurity/status/1498364291468169219" target="_blank" rel="noopener">posted a screenshot on Twitter</a> of a conversation in which one Conti member claims to have a journalist on their payroll who can be hired to write articles that put pressure on victim companies to pay a ransom demand.</p>
<p>&#8220;There is a journalist who will help intimidate them for 5 percent of the payout,&#8221; wrote Conti member &#8220;<strong>Alarm</strong>,&#8221; on March 30, 2021.</p>
<p>The Conti team also had decent working relationships with multiple people who worked at companies that helped ransomware victims navigate paying an extortion demand in virtual currency. One friendly negotiator even had his own nickname within the group &#8212; &#8220;<strong>The Spaniard</strong>&#8221; &#8212; who according to Conti mid-level manager <strong>Mango </strong>is a Romanian man who works for a large ransomware recovery firm in Canada.</p>
<p>&#8220;We have a partner here in the same panel who has been working with this negotiator for a long time, like you can quickly negotiate,&#8221; Trump says to Bio on Dec. 12, 2021, in regards to their <a href="https://www.vitalmx.com/forums/Moto-Related,20/Parts-Unlimited-Cyber-Hack,1397278" target="_blank" rel="noopener">ransomware negotiations</a> with <strong>LeMans Corp</strong>., a large Wisconsin-based distributor of powersports equipment [LeMans declined to comment for this story].</p>
<p>Trump soon after posts a response from their negotiator friend:</p>
<blockquote><p>&#8220;They are willing to pay $1KK [$1 million] quickly. Need decryptors. The board is willing to go to a maximum of $1KK, which is what I provided to you. Hopefully, they will understand. The company revenue is under $100KK [$100 million]. This is not a large organization. Let me know what you can do. But if you have information about their cyber insurance and maybe they have a lot of money in their account, I need a bank payout, then I can bargain. I&#8217;ll be online by 21-00 Moscow time. For now, take a look at the documents and see if there is insurance and bank statements.&#8221;</p></blockquote>
<p>In a different ransom discussion, the negotiator urges Conti to reconsider such a hefty demand.</p>
<p>&#8220;My client only has a max of $200,000 to pay and only wants the data,&#8221; the negotiator wrote on Oct. 7, 2021. &#8220;See what you can do or this deal will not happen.&#8221;</p>
<p>Many organizations now hold cyber insurance to cover the losses associated with a ransomware attack. The logs indicate Conti was ambivalent about working with these victims. For one thing, the insurers seemed to limit their ability to demand astronomical ransom amounts. On the other hand, insured victims usually paid out, with a minimum of hassle or protracted back-and-forth negotiations.</p>
<p>&#8220;They are insured for cyber risks, so what are we waiting for?&#8221; asks Conti upper manager &#8220;<strong>Revers</strong>,&#8221; in a conversation on Sept. 14, 2021.</p>
<p>&#8220;There will be trades with the insurance company?&#8221; asks Conti employee &#8220;<strong>Grant</strong>.&#8221;</p>
<p>&#8220;That&#8217;s not how it works,&#8221; Revers replied. &#8220;They have a coverage budget. We just take it and that&#8217;s it.&#8221;</p>
<p>Conti was an early adopter of the ransomware best practice of &#8220;double extortion,&#8221; which involves charging the victim two separate ransom demands: One in exchange for a digital key needed to unlock infected systems, and another to secure a promise that any stolen data will not be published or sold, and will be destroyed. Indeed, some variation of the message &#8220;need decryptors, deletion logs&#8221; can be seen throughout the chats following the gang&#8217;s receipt of payment from a victim.</p>
<p>Conti victims were directed to a page on the dark web that included a countdown timer. Victims who failed to negotiate a payment before the timer expired could expect to see their internal data automatically published on Conti&#8217;s victim shaming blog.</p>
<p>The beauty of the double extortion approach is that even when victims refuse to pay for a decryption key &#8212; perhaps because they&#8217;re confident they can restore systems from backups &#8212; they might still pay to keep the breach quiet.</p>
<p>&#8220;Hello [victim company redacted],&#8221; the gang wrote in January 2022. &#8220;We are Conti Group. We want to inform that your company local network have been hacked and encrypted. We downloaded from your network more than 180GB of sensitive data. &#8211; Shared HR &#8211; Shared_Accounting &#8211; Corporate Debt &#8211; Departments. You can see your page in the our blog here [dark web link]. Your page is hidden. But it will be published if you do not go to the negotiations.&#8221;</p>
<p>&#8220;We came to an agreement before the New Year,&#8221; Conti member &#8220;<strong>Skippy</strong>&#8221; wrote later in a message to the victim company. &#8220;You got a lot of time, more than enough to find any sum and fulfill your part of this agreement. However, you now ask for additional time, additional proofs, etc. Seems like you are preparing to break the agreement and flee, or just to decrease the sum. Moreover, it is a very strange request and explanation. A lot of companies pay such amounts without any problems. So, our answer: We are waiting for the above mentioned sum until 5 February. We keep our words. If we see no payment and you continue to add any conditions, we begin to upload data. That is all.&#8221;</p>
<p>And a reputation for keeping their word is what makes groups like Conti so feared. But some may come to question the group&#8217;s competence, and whether it may now be too risky to work with them.</p>
<p>On Mar. 3, a new Twitter account called &#8220;Trickbotleaks&#8221; began posting the names, photos and personal information of what the account claimed were top Trickbot administrators, including information on many of the Conti nicknames mentioned throughout this story. The Trickbotleaks Twitter account was suspended less than 24 hours later.</p>
<p>On Mar. 2, the Twitter account that originally leaked the Conti chat (a.k.a. &#8220;jabber&#8221;) records posted fresh logs from the Conti chat room, proving the infiltrator still had access and that Conti hadn&#8217;t figured out how they&#8217;d been had.</p>
<p>&#8220;Ukraine will rise!,&#8221; the account <a href="https://twitter.com/ContiLeaks/status/1499099046966931459" target="_blank" rel="noopener">tweeted</a>. &#8220;Fresh jabber logs.&#8221;</p>
<p>There may yet be at least one more piece in this series. Look here next week for a story about some of Conti&#8217;s more interesting extracurricular moneymaking and investment schemes.</p>


feed_id: https://krebsonsecurity.com/?p=58766
title: Conti Ransomware Group Diaries, Part IV: Cryptocrime
uri: Conti-Ransomware-Group-Diaries-Part-IV-Cryptocrime
url: https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-iv-cryptocrime/
content:
<p><img loading="lazy" class="aligncenter wp-image-58826" src="media/c2ac1185.blockchainsmartcontracts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/blockchainsmartcontracts.png" alt="" width="759" height="330" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/blockchainsmartcontracts.png 936w, https://krebsonsecurity.com/wp-content/uploads/2022/03/blockchainsmartcontracts-768x334.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/blockchainsmartcontracts-782x340.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></p>
<p>Three stories here last week pored over several years’ worth of internal chat records stolen from the <strong>Conti</strong> ransomware group, the most profitable ransomware gang in operation today. The candid messages revealed how Conti <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">evaded law enforcement and intelligence agencies</a>, what it was like on <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/" target="_blank" rel="noopener">a typical day at the Conti office</a>, and how Conti <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-iii-weaponry/" target="_blank" rel="noopener">secured the digital weaponry used in their attacks</a>. This final post on the Conti conversations explores different schemes that Conti pursued to invest in and steal cryptocurrencies.</p>
<p>When you&#8217;re perhaps the most successful ransomware group around &#8212; Conti made $180 million last year in extortion payments, <a href="media/bc6a14ea.contistats-768x391.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats-768x391.png" rel="noopener" target="_blank">well more than any other crime group</a>, according to <strong>Chainalysis</strong> &#8212; you tend to have a lot digital currency like Bitcoin. </p>
<p>This wealth allowed Conti to do things that regular investors couldn&#8217;t &#8212; such as moving the price of cryptocurrencies in one direction or the other. Or building a cryptocurrency platform and seeding it with loads of ill-gotten crypto from phantom investors.</p>
<p>One Conti top manager &#8212; aptly-named &#8220;<strong>Stern</strong>&#8221; because he incessantly needled Conti underlings to complete their assigned tasks &#8212; was obsessed with the idea of creating his own crypto scheme for cross-platform blockchain applications.</p>
<p>&#8220;I&#8217;m addicted right now, I&#8217;m interested in trading, defi, blockchain, new projects,&#8221; Stern told &#8220;<strong>Bloodrush</strong>&#8221; on Nov. 3, 2021. &#8220;Big companies have too many secrets that they hold on to, thinking that this is their main value, these patents and data.&#8221;</p>
<p>In a discussion thread that spanned many months in Conti&#8217;s internal chat room, Stern said the plan was to create their own crypto universe.</p>
<p>&#8220;Like Netherium, Polkadot and Binance smart chain, etc.,&#8221; Stern wrote. &#8220;Does anyone know more about this? Study the above systems, code, principles of work. To build our own, where it will already be possible to plug in NFT, DEFI, DEX and all the new trends that are and will be. For others to create their own coins, exchanges and projects on our system.&#8221;</p>
<p>It appears that Stern has been paying multiple developers to pursue the notion of building a peer-to-peer (P2P) based system for &#8220;smart contracts&#8221; &#8212; programs stored on a blockchain that run whenever predetermined conditions are met.</p>
<p>It&#8217;s unclear under what context the Conti gang was interested in smart contracts, but the idea of a ransomware group insisting on payments via smart contracts is not entirely new. In 2020, researchers from <strong>Athens University School of Information Sciences and Technology</strong> in Greece <a href="media/8cc8afd3.2003.04426.pdf" data-original-source="https://arxiv.org/pdf/2003.04426.pdf" target="_blank" rel="noopener">showed</a> (PDF) how ransomware-as-a-service offerings might one day be executed through smart contracts.</p>
<p>Before that, <strong>Jeffrey Ladish</strong>, an information security consultant based in Oakland, Calif., penned a <a href="https://medium.com/reserve-currency/smart-contracts-will-make-ransomware-more-profitable-part-1-a687fc370320" target="_blank" rel="noopener">two-part analysis</a> on why smart contracts will make ransomware more profitable.</p>
<p>&#8220;By using a smart contract, an operator can trustlessly sell their victims a decryption key for money,&#8221; Ladish wrote. &#8220;That is, a victim can send some money to a smart contract with a guarantee that they will either receive the decryption key to their data or get their money back. The victim does not have to trust the person who hacked their computer because they can verify that the smart contract will fairly handle the exchange.&#8221;</p>
<p>The Conti employee &#8220;<strong>Van</strong>&#8221; appears to have taken the lead on the P2P crypto platform, which he said was being developed using the Rust programming language.</p>
<p>&#8220;I am trying to make a p2p network in Rust,&#8221; Van told a co-worker &#8220;<strong>Demon</strong>&#8221; on Feb. 19, 2022. &#8220;I&#8217;m sorting it out and have already started writing code.&#8221;</p>
<p>&#8220;It&#8217;s cool you like Rust,&#8221; Demon replied. &#8220;I think it will help us with smart contracts.&#8221;</p>
<p>Stern apparently believed in his crypto dreams so much that he sponsored a $100,000 article writing contest on the Russian language cybercrime forum Exploit, asking interested applicants to put forth various ideas for crypto platforms. Such contests are an easy way to buy intellectual property for ongoing projects, and they&#8217;re also effective recruiting tools for cybercriminal organizations.</p>
<p>&#8220;Cryptocurrency article contest! [100.000$],&#8221; wrote mid-level Conti manager &#8220;Mango,&#8221; to boss Stern, copying the title of the post on the Exploit forum. &#8220;What the hell are you doing there&#8230;&#8221;</p>
<p>A few days later Mango reports to Stern that he has &#8220;prepared everything for both the social network and articles for crypto contests.&#8221;<span id="more-58766"></span></p>
<h2>DISTRIBUTED DENIAL OF DISCORD?</h2>
<p><img loading="lazy" class="aligncenter wp-image-58823" src="media/7e12fa45.ddosbombs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/ddosbombs.png" alt="" width="530" height="532" /></p>
<p>On June 6, 2021, Conti underling &#8220;<strong>Begemot</strong>&#8221; pitched Stern on a scheme to rip off a bunch of people mining virtual currencies, by launching distributed denial-of-service (DDoS) attacks against a cryptocurrency mining pool.</p>
<p>&#8220;We find young forks on exchanges (those that can be mined), analyze their infrastructure,&#8221; Begemot wrote.</p>
<p>Begemot continues:</p>
<blockquote><p>&#8220;Where are the servers, nodes, capitalization, etc. Find a place where crypto holders communicate (discord, etc. ). Let&#8217;s find out the IP of the node. Most likely it will be IPv6. We start ddosing. We fly into the chat that we found earlier and write that there are problems, the crypt is not displayed, operations are not carried out (because the crypt depends on mining, there will really be problems ). Holders start to get nervous and withdraw the main balance. Crypto falls in price. We buy at a low price. We release ddos. Crypto grows again. We gain. Or a variant of a letter to the creators about the possibility of a ransom if they want the ddos ​​to end. From the main problem points, this is the implementation of Ipv6 DDoS.&#8221;</p></blockquote>
<p>Stern replies that this is an excellent idea, and asks Begemet to explain how to identify the IP address of the target.</p>
<h2>SQUID GAMES</h2>
<p>It appears Conti was involved in &#8220;<strong>SQUID</strong>,&#8221; a new cryptocurrency which turned out to be a giant social media scam that netted the fraudsters millions of dollars. On Oct. 31, 2021, Conti member &#8220;<strong>Ghost</strong>&#8221; sent a message to his colleagues that a big &#8220;pump&#8221; moneymaking scheme would be kicking off in 24 hours. In crypto-based pump-and-dump scams, the conspirators use misleading information to inflate the price of a currency, after which they sell it at a profit.</p>
<p>&#8220;The big day has arrived,&#8221; Ghost wrote. &#8220;24 hours remaining until the biggest pump signal of all time! The target this time will be around 400% gains possibly even more. We will be targeting 100 million $ volume. With the bull market being in full effect and volumes being high, the odds of reaching 400% profit will be very high once again. We will do everything in our power to make sure we reach this target, if you have missed our previous big successful pumps, this is also the one you will not want to miss. A massive pump is about to begin in only 24 hours, be prepared.&#8221;</p>
<p>Ghost&#8217;s message doesn&#8217;t mention which crypto platform would be targeted by the scam. But the timing aligns with a pump-and-dump executed against the SQUID cryptocurrency (supposedly inspired by the popular South Korean Netflix series). SQUID was first offered to investors on Oct. 20, 2021.</p>
<div id="attachment_58825" style="width: 766px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58825" loading="lazy" class=" wp-image-58825" src="media/7a4acad4.squidgamesite.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/squidgamesite.png" alt="" width="756" height="361" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/squidgamesite.png 1010w, https://krebsonsecurity.com/wp-content/uploads/2022/03/squidgamesite-768x367.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/squidgamesite-782x373.png 782w" sizes="(max-width: 756px) 100vw, 756px" /><p id="caption-attachment-58825" class="wp-caption-text">The now-defunct website for the cryptocurrency scam SQUID.</p></div>
<p>As <em>Gizmodo</em> <a href="https://gizmodo.com/squid-game-cryptocurrency-scammers-make-off-with-2-1-m-1847972824" target="_blank" rel="noopener">first reported on Nov. 1, 2021</a>, just prior to the scam SQUID was trading at just one cent, but in less than a week its price had jumped to over $2,856.</p>
<p>Gizmodo referred to the scam as a &#8220;rug pull,&#8221; which happens when the promoter of a digital token draws in buyers, stops trading activity and makes off with the money raised from sales. SQUID&#8217;s developers made off with an estimated $3.38 million (£2.48m).</p>
<p>&#8220;The SQUID crypto coin was launched just last week and included plenty of red flags, including a three-week old website filled with bizarre spelling and grammatical errors,&#8221; Gizmodo&#8217;s <strong>Matt Novak</strong> wrote. &#8220;The website, hosted at SquidGame.cash, has disappeared, along with every other social media presence set up by the scammers.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58854
title: Internet Backbone Giant Lumen Shuns .RU
uri: Internet-Backbone-Giant-Lumen-Shuns-RU
url: https://krebsonsecurity.com/2022/03/internet-backbone-giant-lumen-shuns-ru/
content:
<p><strong>Lumen Technologies</strong>, an American company that operates one of the largest Internet backbones and carries a significant percentage of the world&#8217;s Internet traffic, said today it will stop routing traffic for organizations based in Russia. Lumen&#8217;s decision comes just days after a similar exit by backbone provider <strong>Cogent</strong>, and amid a news media crackdown in Russia that has already left millions of Russians in the dark about what is really going on with their president&#8217;s war in Ukraine.</p>
<p><img loading="lazy" class="aligncenter wp-image-44395" src="media/9cf86404.shunned.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/shunned.jpg" alt="" width="751" height="503" /></p>
<p>Monroe, La. based Lumen [<a href="https://www.google.com/finance/quote/LUMN:NYSE" target="_blank" rel="noopener">NYSE: LUMN</a>] (formerly <strong>CenturyLink</strong>) initially said it would halt all new business with organizations based in Russia, leaving open the possibility of continuing to serve existing clients there. But on Tuesday the company said it could no longer justify that stance.</p>
<p>&#8220;Life has taken a turn in Russia and Lumen is unable to continue to operate in this market,&#8221; Lumen said in a published statement. &#8220;The business services we provide are extremely small and very limited as is our physical presence. However, we are taking steps to immediately stop business in the region.&#8221;</p>
<p>&#8220;We decided to disconnect the network due to increased security risk inside Russia,&#8221; the statement continues. &#8220;We have not yet experienced network disruptions but given the increasingly uncertain environment and the heightened risk of state action, we took this move to ensure the security of our and our customers’ networks, as well as the ongoing integrity of the global Internet.&#8221;</p>
<p>According to Internet infrastructure monitoring firm <strong>Kentik</strong>, Lumen is the top international transit provider to Russia, with customers including Russian telecom giants Rostelecom and TTK, as well as all three major mobile operators (MTS, Megafon and VEON).</p>
<p>&#8220;A backbone carrier disconnecting its customers in a country the size of Russia is without precedent in the history of the internet and reflects the intense global reaction that the world has had over the invasion of Ukraine,&#8221; <a href="https://www.kentik.com/blog/cogent-disconnects-from-russia/" target="_blank" rel="noopener">wrote</a> <strong>Doug Madory</strong>, Kentik&#8217;s director of Internet analysis.</p>
<p>It&#8217;s not clear whether any other Internet backbone providers &#8212; some of which are based outside of the United States &#8212; will follow the lead of Lumen and Cogent. But Madory notes that as economic sanctions continue to exact a toll on Russia&#8217;s economy, its own telecommunications firms may have difficulty paying foreign transit providers for service.</p>
<p>Ukrainian leaders petitioned the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN) &#8212; the nonprofit organization charged with overseeing the global domain name system &#8212; to disconnect Russia&#8217;s top-level domain (.ru) from the Internet. ICANN respectfully declined that request, but many technology giants, including Amazon, Apple and Microsoft, have moved on their own to suspend new business in the country.</p>
<p>Meanwhile, Russia recently cracked down on the last remaining vestiges of a free press within its borders, passing a new law that threatens up to 15 years in jail for anyone who publishes content that refers to the conflict in Ukraine as a &#8220;war&#8221; or &#8220;invasion.&#8221;<span id="more-58854"></span></p>
<p>As <strong>Neil MacFarquhar</strong> <a href="https://www.nytimes.com/2022/03/08/world/europe/russia-ukraine-media.html?action=click&amp;module=RelatedLinks&amp;pgtype=Article" target="_blank" rel="noopener">writes</a> for <em>The New York Times</em>, what little coverage there is on Russian television networks about the invasion does not include any footage of the devastation wrought by Russian troops on the Ukrainian citizenry. At the same time, the Russian government has blocked <strong>Facebook</strong> and partly blocked <strong>Twitter</strong>, while other platforms like <strong>TikTok</strong> have suspended services in the country.</p>
<p>&#8220;To spend several days watching news broadcasts on the main state channels, as well as surveying state-controlled newspapers, is to witness the extent of the Kremlin’s efforts to sanitize its war with the Orwellian term &#8216;special military operation&#8217; — and to make all news coverage align with that message,&#8221; MacFarquhar wrote.</p>
<p><em>The Washington Post</em>, which was the first to report on Cogent&#8217;s decision last week, <a href="https://www.washingtonpost.com/technology/2022/03/08/lumen-internet-russia-backbone-cut/" target="_blank" rel="noopener">wrote</a> that these independent actions by private tech companies collectively &#8220;will leave Russians more dependent than ever on government propaganda that already dominates the nation’s newspapers and broadcast stations, leaving few ways to access independent sources of news at a time when the country has entered a severe political crisis.&#8221;</p>
<p>In a blog post titled &#8220;<a href="https://www.internetsociety.org/blog/2022/03/why-the-world-must-resist-calls-to-undermine-the-internet/" rel="noopener" target="_blank">Why the World Must Resist Calls to Undermine the Internet</a>,&#8221; Internet Society President <strong>Andrew Sullivan</strong> said cutting a whole population off the Internet will stop disinformation coming from that population — but it also stops the flow of truth.</p>
<p>&#8220;Without the Internet, the rest of the world would not know of atrocities happening in other places,&#8221; Sullivan wrote. &#8220;And without the Internet, ordinary citizens of many countries wouldn’t know what was being carried out in their name. Our best hope, however dim, is that those supporting an aggressive regime will change their support. More information can help, even as disinformation circulates. We need a better understanding of what is and is not disinformation.&#8221;</p>
<p>There is another &#8212; perhaps less popular &#8212; camp, which holds that isolating Russia from the rest of the Internet might be THE thing that encourages more Russians to protest the war in Ukraine, and ultimately to take back control of their own country from its autocratic and kleptocratic leaders.</p>
<p>Not long after Russia invaded Ukraine, I heard from an old pen-pal in Ukraine: <strong>Sergey Vovnenko</strong>, a.k.a. &#8220;Flycracker,&#8221; a.k.a the convicted Ukrainian cybercriminal who once <a href="https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/" target="_blank" rel="noopener">executed a plot to have me framed for heroin possession</a>. Vovnenko did his time in a U.S. prison, left Fly behind, and we have since buried the hatchet. He&#8217;s now hunkered down in Lviv, Ukraine, which is serving as a major artery for refugees seeking shelter outside Ukraine&#8217;s borders.</p>
<p>These days, Vovnenko says he is working with many sympathetic hackers to fight the Russians online. Asked what he thought about the idea of Russia being isolated from the rest of the Internet, Vovnenko said it couldn&#8217;t happen soon enough given the Russian government&#8217;s <a href="https://twitter.com/kamilkazani/status/1500495309595725831" target="_blank" rel="noopener">new media blitz to cast the war in a patriotic light</a>.</p>
<p>&#8220;I think they should be disconnected, maybe Russian people will rebel against Putin after that,&#8221; he said.</p>


feed_id: https://krebsonsecurity.com/?p=58876
title: Microsoft Patch Tuesday, March 2022 Edition
uri: Microsoft-Patch-Tuesday-March-2022-Edition
url: https://krebsonsecurity.com/2022/03/microsoft-patch-tuesday-march-2022-edition/
content:
<p><strong>Microsoft</strong> on Tuesday released software updates to plug at least 70 security holes in its <strong>Windows</strong> operating systems and related software. For the second month running, there are no scary zero-day threats looming for Windows users (that we know of), and relatively few &#8220;critical&#8221; fixes. And yet we know from experience that attackers are already trying to work out how to turn these patches into a roadmap for exploiting the flaws they fix. Here&#8217;s a look at the security weaknesses Microsoft says are most likely to be targeted first.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="725" height="532" /></p>
<p><strong>Greg Wiseman</strong>, product manager at <strong>Rapid7</strong>, notes that three vulnerabilities fixed this month have been previously disclosed, potentially giving attackers a head start in working out how to exploit them. Those include remote code execution bugs <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24512" target="_blank" rel="noopener">CVE-2022-24512</a>, affecting <strong>.NET</strong> and <strong>Visual Studio</strong>, and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21990" target="_blank" rel="noopener">CVE-2022-21990</a>, affecting <strong>Remote Desktop Client</strong>. <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24459" target="_blank" rel="noopener">CVE-2022-24459</a> is a vulnerability in the <strong>Windows Fax and Scan</strong> service. All three publicly disclosed vulnerabilities are rated &#8220;<a href="https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system?SilentAuth=1&amp;wa=wsignin1.0" target="_blank" rel="noopener">Important</a>&#8221; by Microsoft.</p>
<p>Just three of the fixes this month earned Microsoft&#8217;s most-dire &#8220;<strong>Critical</strong>&#8221; rating, which Redmond assigns to bugs that can be exploited to remotely compromise a Windows PC with little to no help from users. Two of those critical flaws involve Windows video codecs. Perhaps the most concerning critical bug quashed this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-23277" target="_blank" rel="noopener">CVE-2022-23277</a>, a  remote code execution flaw affecting <strong>Microsoft Exchange Server</strong>.</p>
<p>&#8220;Thankfully, this is a post-authentication vulnerability, meaning attackers need credentials to exploit it,&#8221; Wiseman said. &#8220;Although passwords can be obtained via phishing and other means, this one shouldn’t be as rampantly exploited as the <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">deluge of Exchange vulnerabilities we saw throughout 2021</a>. Exchange administrators should still patch as soon as reasonably possible.&#8221;</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24508" target="_blank" rel="noopener">CVE-2022-24508</a> is a remote code execution bug affecting <strong>Windows SMBv3</strong>, the technology that handles file sharing in Windows environments.</p>
<p>&#8220;This has potential for widespread exploitation, assuming an attacker can put together a suitable exploit,&#8221; Wiseman said. &#8220;Luckily, like this month&#8217;s Exchange vulnerabilities, this, too, requires authentication.&#8221;<span id="more-58876"></span></p>
<p><strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>, called attention to a trio of bugs fixed this month in the <strong>Windows Remote Desktop Protocol</strong> (RDP), which is a favorite target of ransomware groups.</p>
<p>&#8220;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-23285" target="_blank" rel="noopener">CVE-2022-23285</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21990" target="_blank" rel="noopener">CVE-2022-21990</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24503" target="_blank" rel="noopener">CVE-2022-24503</a> are a potential concern especially as this infection vector is commonly used by ransomware actors,&#8221; Breen said. &#8220;While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.&#8221;</p>
<p>March&#8217;s Patch Tuesday also brings an unusual update (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21967" target="_blank" rel="noopener">CVE-2022-21967</a>) that might just be the first security patch involving Microsoft&#8217;s <strong>Xbox</strong> device.</p>
<p>“This appears to be the first security patch impacting Xbox specifically,” said <strong>Dustin Childs</strong> from <strong>Trend Micro&#8217;s Zero Day Initiative</strong>. “There was an advisory for an inadvertently disclosed Xbox Live certificate back in 2015, but this seems to be the first security-specific update for the device itself.”</p>
<p>Also on Tuesday, Adobe <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">released updates</a> addressing six vulnerabilities in <strong>Adobe Photoshop</strong>, <strong>Illustrator</strong> and <strong>After Effects</strong>.</p>
<div class="entry-content">
<p>For a complete rundown of all patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+March+2022+Patch+Tuesday/28418/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/2022/march-madness-patching-begins/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these patches, please drop a note about it here in the comments.</p>
</div>


feed_id: https://krebsonsecurity.com/?p=58886
title: Report: Recent 10x Increase in Cyberattacks on Ukraine
uri: Report-Recent-10x-Increase-in-Cyberattacks-on-Ukraine
url: https://krebsonsecurity.com/2022/03/report-recent-10x-increase-in-cyberattacks-on-ukraine/
content:
<p>As their cities suffered more intense bombardment by Russian military forces this week, Ukrainian Internet users came under renewed cyberattacks, with one Internet company providing service there saying they blocked ten times the normal number of phishing and malware attacks targeting Ukrainians.</p>
<p><img loading="lazy" class="aligncenter wp-image-58898" src="media/f5a5319c.ua-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/ua-ru.png" alt="" width="760" height="277" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/ua-ru.png 804w, https://krebsonsecurity.com/wp-content/uploads/2022/03/ua-ru-768x280.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/ua-ru-782x285.png 782w" sizes="(max-width: 760px) 100vw, 760px" /></p>
<p><strong>John Todd</strong> is general manager of <a href="https://www.quad9.net/news/blog/quad9-and-your-data/" target="_blank" rel="noopener">Quad9</a>, a free &#8220;anycast&#8221; DNS platform. DNS stands for Domain Name System, which is like a globally distributed phone book for the Internet that maps human-friendly website names (example.com) to numeric Internet addresses (8.8.4.4.) that are easier for computers to manage. Your computer or mobile device generates DNS lookups each time you send or receive an email, or browse to a webpage.</p>
<p>With anycast, one Internet address can apply to many servers, meaning that any one of a number of DNS servers can respond to DNS queries, and usually the one that is geographically closest to the customer making the request will provide the response.</p>
<p>Quad9 insulates its users from a range of cyberattacks by blocking DNS requests for known-bad domain names, i.e., those confirmed to be hosting malicious software, phishing websites, stalkerware and other threats. And normally, the ratio of DNS queries coming from Ukraine that are allowed versus blocked by Quad9 is fairly constant.</p>
<p>But Todd says that on March 9, Quad9&#8217;s systems blocked 10 times the normal number of DNS requests coming from Ukraine, and to a lesser extent Poland.</p>
<p>Todd said Quad9 saw a significant drop in traffic reaching its Kyiv POP [point of presence] during the hostilities, presumably due to fiber cuts or power outages. Some of that traffic then shifted to Warsaw, which for much of Ukraine’s networking is the next closest significant interconnect site.</p>
<div id="attachment_58897" style="width: 769px" class="wp-caption aligncenter"><a href="media/0d025b95.q9-ua.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/q9-ua.png"><img aria-describedby="caption-attachment-58897" loading="lazy" class="wp-image-58897" src="media/0d025b95.q9-ua.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/q9-ua.png" alt="" width="759" height="206" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/q9-ua.png 1235w, https://krebsonsecurity.com/wp-content/uploads/2022/03/q9-ua-768x208.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/q9-ua-782x212.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></a><p id="caption-attachment-58897" class="wp-caption-text">Quad9&#8217;s view of a spike in malicious traffic targeting Ukrainian users this week. Click to enlarge.</p></div>
<p>&#8220;While our overall traffic dropped in Kyiv &#8212; and slightly increased in Warsaw due to infrastructure outages inside of .ua &#8212; the ratio of (good queries):(blocked queries) has spiked in both cities,&#8221; he continued. &#8220;The spike in that blocking ratio [Wednesday] afternoon in Kyiv was around 10x the normal level when comparing against other cities in Europe (Amsterdam, Frankfurt.) While Ukraine always is slightly higher (20%-ish) than Western Europe, this order-of-magnitude jump is unprecedented.&#8221;</p>
<p>Quad9 declined to further quantify the data that informed the Y axis in the chart above, but said there are some numbers the company is prepared to share as absolutes.</p>
<p>&#8220;Looking three weeks ago on the same day of the week as yesterday, we had 118 million total block events, and of that 1.4 million were in Ukraine and Poland,&#8221; Todd said. &#8220;Our entire network saw yesterday on March 9th 121 million blocking events, worldwide. Of those 121 million events, 4.6 million were in Ukraine and Poland.&#8221;</p>
<p><strong>Bill Woodcock</strong> is executive director at <a href="https://www.pch.net" target="_blank" rel="noopener">Packet Clearing House</a>, a nonprofit based in San Francisco that is one of several sponsors of Quad9. Woodcock said the spike in blocked DNS queries coming out of Ukraine clearly shows an increase in phishing and malware attacks against Ukrainians.</p>
<p>&#8220;They&#8217;re being targeted by a huge amount of phishing, and a lot of malware that is getting onto machines is trying to contact malicious command-and-control infrastructure,&#8221; Woodcock said.</p>
<p>Both Todd and Woodcock said the smaller spike in blocked DNS requests originating from Poland is likely the result of so many Ukrainians fleeing their country: Of the two million people who have fled Ukraine since the beginning of the Russian invasion, more than 1.4 million have made their way to Poland, according to <a href="https://www.bbc.com/news/world-60555472" target="_blank" rel="noopener">the latest figures</a> from the <strong>United Nations</strong>.</p>
<p>The increase in malicious activity detected by Quad9 is the latest chapter in an ongoing series of cyberattacks against Ukrainian government and civilian systems since the outset of the war in the last week of February.</p>
<p>As Russian military tanks and personnel began crossing the border into Ukraine last month, security experts tracked a series of <a href="https://zetter.substack.com/p/second-wiper-attack-strikes-systems" target="_blank" rel="noopener">destructive data &#8220;wiper&#8221; attacks</a> aimed at Ukrainian government agencies and contractor networks. Security firms also <a href="https://www.bleepingcomputer.com/news/security/white-house-pins-ukraine-ddos-attacks-on-russian-gru-hackers/" target="_blank" rel="noopener">attributed to Russia&#8217;s intelligence services</a> a volley of distributed denial-of-service (DDoS) attacks against Ukrainian banks just prior to the invasion.</p>
<p>Thus far, the much-feared large scale cyberattacks and retaliation from Russia <a href="https://www.nytimes.com/2022/03/11/opinion/russia-ukraine-cyberattacks.html" target="_blank" rel="noopener">haven&#8217;t materialized</a> (for a counterpoint here, see <a href="https://www.theguardian.com/technology/2022/mar/10/us-russia-cyber-attack-prepared" target="_blank" rel="noopener">this piece</a> from <em>The Guardian</em>). But the data collected by Quad9 suggest that a great deal of low-level cyberattacks targeting Ukrainians remain ongoing.</p>
<p>It is unclear to what extent &#8212; if any &#8212; Russia&#8217;s vaunted cyber prowess may be stymied by mounting economic sanctions enacted by both private companies and governments. In the past week, two major backbone Internet providers <a href="https://krebsonsecurity.com/2022/03/internet-backbone-giant-lumen-shuns-ru/" target="_blank" rel="noopener">said they would stop routing traffic for Russia</a>.</p>
<p>Earlier today, the <strong>London Internet Exchange</strong> (LINX), one of the largest peering points where networks around the world exchange traffic, <a href="https://twitter.com/briankrebs/status/1502298540701323264" target="_blank" rel="noopener">said</a> it would stop routing for Russian Internet service providers <strong>Rostelecom</strong> and <strong>MegaFon</strong>. Rostelecom is Russia&#8217;s largest ISP, while MegaFon is Russia&#8217;s second-largest mobile phone operator and third largest ISP.</p>
<p><strong>Doug Madory</strong>, director of research for Internet infrastructure monitoring firm <a href="https://www.kentik.com" target="_blank" rel="noopener">Kentik</a>, said LINX&#8217;s actions will further erode the connectivity of these large Russia providers to the larger Internet.</p>
<p>&#8220;If the other major European exchanges followed suit, it could be really problematic for Russian connectivity,&#8221; Madory said.</p>


feed_id: https://krebsonsecurity.com/?p=58917
title: Lawmakers Probe Early Release of Top RU Cybercrook
uri: Lawmakers-Probe-Early-Release-of-Top-RU-Cybercrook
url: https://krebsonsecurity.com/2022/03/lawmakers-probe-early-release-of-top-ru-cybercrook/
content:
<div id="attachment_49530" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49530" loading="lazy" class=" wp-image-49530" src="media/a23ec59c.burkov-jerusalem-getty.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/burkov-jerusalem-getty.png" alt="" width="757" height="477" /><p id="caption-attachment-49530" class="wp-caption-text">Aleksei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Image: Andrei Shirokov / Tass via Getty Images.</p></div>
<p><strong>Aleksei Burkov</strong>, a cybercriminal who long operated two of Russia&#8217;s most exclusive underground hacking forums, was arrested in 2015 by Israeli authorities. The Russian government fought Burkov&#8217;s extradition to the U.S. for four years &#8212; even arresting and jailing an Israeli woman to force a prisoner swap. That effort failed: Burkov was sent to America, pleaded guilty, and was sentenced to nine years in prison. But a little more than a year later, he was quietly released and deported back to Russia. Now some Republican lawmakers are asking why a Russian hacker once described as &#8220;an asset of supreme importance&#8221; was allowed to shorten his stay.</p>
<p>A native of St. Petersburg, Russia, Burkov admitted to running CardPlanet, a site that sold more than 150,000 stolen credit card accounts, and to being a founder of DirectConnection — a closely guarded online community that attracted some of the world’s most-wanted Russian hackers.</p>
<p>But Burkov&#8217;s cybercriminal activities spanned far beyond mere credit card fraud. A <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener">2019 deep dive into Burkov&#8217;s hacker alias &#8220;K0pa&#8221;</a> revealed he also was co-administrator of the secretive Russian cybercrime forum &#8220;<a href="https://krebsonsecurity.com/2021/03/three-top-russian-cybercrime-forums-hacked/" target="_blank" rel="noopener">Mazafaka</a>.&#8221; Like DirectConnection, Mazafaka&#8217;s member roster was a veritable &#8220;Who&#8217;s Who?&#8221; of the Russian hacker underground, and K0pa played a key role in vetting new members and settling disputes for both communities.</p>
<p>K0pa&#8217;s elevated status in the Russian cybercrime community made him one of the most connected malicious hackers ever apprehended by U.S. authorities. As I wrote at the time of Burkov&#8217;s extradition, the Kremlin was probably concerned that he simply knew too much about Russia&#8217;s propensity to outsource certain activities to its criminal hacker community.</p>
<p>&#8220;To my knowledge, no one has accused Burkov of being some kind of cybercrime fixer or virtual badguy Rolodex for the Russian government,&#8221; KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener">wrote</a> in 2019. &#8220;On the other hand, from his onetime lofty perch atop some of the most exclusive Russian cybercrime forums, K0pa certainly would have fit that role nicely.&#8221;</p>
<p>Burkov was arrested in December 2015 on an international warrant while visiting Israel, and over the ensuing four years the Russian government aggressively sought to keep him from being extradited to the United States.</p>
<p>When Israeli authorities turned down requests to send him back to Russia — supposedly to face separate hacking charges there — the Russians imprisoned Israeli citizen <strong>Naama Issachar</strong> on trumped-up drug charges in a bid to trade prisoners. Nevertheless, Burkov was extradited to the United States in November 2019.</p>
<p>And if there were any doubts Issachar was jailed for use as a political pawn, Russian President <strong>Vladimir Putin</strong> erased those by <a href="https://www.bbc.com/news/world-europe-51301827" target="_blank" rel="noopener">pardoning her</a> in January 2020, <a href="https://krebsonsecurity.com/2020/01/russian-cybercrime-boss-burkov-pleads-guilty/" target="_blank" rel="noopener">just hours after Burkov pleaded guilty in the United States</a>.</p>
<p>In June 2020, Burkov was <a href="https://krebsonsecurity.com/2020/06/russian-cybercrime-boss-burkov-gets-9-years/" target="_blank" rel="noopener">sentenced to nine years in prison</a>. But a little more than a year later &#8212; Aug. 25, 2021 &#8212; Burkov was released and deported back to Russia. According to <a href="media/ea028350.Letter-to-Sullivan-on-Aleksei-Burkov.pdf" data-original-source="https://gop-foreignaffairs.house.gov/wp-content/uploads/2022/03/Letter-to-Sullivan-on-Aleksei-Burkov.pdf" target="_blank" rel="noopener">a letter</a> (PDF) sent Monday by four Republican House lawmakers to White House National Security Advisor <strong>Jake Sullivan</strong>, U.S. Immigration and Customs Enforcement (ICE) officials escorted Burkov onto a plane destined for Moscow shortly after his release.<span id="more-58917"></span></p>
<p>&#8220;An ICE spokesperson stated that Burkov is wanted by Russian authorities, and a DOJ spokesperson denied that a prisoner exchange took place,&#8221; the letter reads. &#8220;The decision to prematurely release Burkov is curious given the lengths to which the U.S. government went to secure Burkov’s arrest.&#8221;</p>
<p>The letter, signed by the ranking members of the House Judiciary, Homeland Security, Intelligence and Foreign Affairs committees, demanded to know why Burkov was released prematurely, and whether the U.S. received anything in return. The lawmakers also asked for a list of all Russian nationals convicted of crimes in the U.S. who were released early since President Biden took office.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-58935" src="media/1f2385d3.hgopltr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/hgopltr.png" alt="" width="665" height="786" /></p>
<p>Records show Burkov was in the custody of either Israeli or U.S. authorities for almost five years prior to his sentencing in 2020. At the time of his release, Burkov had already been incarcerated for nearly six years. So where did the other years of his sentence go?</p>
<p>That remains unclear, but it is possible he cut some sort of deal to lessen his sentence. On June 16, 2021, a &#8220;sealed pleading&#8221; was added to Burkov&#8217;s court record, followed by a sealed document entered on Aug. 18 &#8212; a week before Burkov&#8217;s deportation.</p>
<p>The motion to seal these and other documents related to the pleading was made by U.S. federal prosecutors, and those documents remain hidden from public viewing.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-58933" src="media/42ef7b1e.burkovdocs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/burkovdocs.png" alt="" width="594" height="786" /></p>


feed_id: https://krebsonsecurity.com/?p=58969
title: Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware
uri: Pro-Ukraine-Protestware-Pushes-Antiwar-Ads-Geo-Targeted-Malware
url:
https://krebsonsecurity.com/2022/03/pro-ukraine-protestware-pushes-antiwar-ads-geo-targeted-malware/

content:
<p>Researchers are tracking a number of open-source &#8220;<strong>protestware</strong>&#8221; projects on <strong>GitHub</strong> that have recently altered their code to display &#8220;Stand with Ukraine&#8221; messages for users, or basic facts about the carnage in Ukraine. The group also is tracking several code packages that were recently modified to erase files on computers that appear to be coming from Russian or Belarusian Internet addresses.</p>
<p><img class="aligncenter wp-image-58985" src="media/6cc211eb.PROTESTWARE.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/PROTESTWARE.png" alt="" width="755" height="153" /></p>
<p>The <a href="https://github.com/ThorgrimGrudgebearer/GreatBookOfGrudges/blob/main/README.md" target="_blank" rel="noopener">upstart tracking effort</a> is being crowdsourced via <strong>Telegram</strong>, but the output of the Russian research group is centralized in <a href="https://docs.google.com/spreadsheets/d/1H3xPB4PgWeFcHjZ7NOPtrcya_Ua4jUolWm-7z9-jSpQ/htmlview?pru=AAABf7z88MA*ITSp0EBrKinw0LjFWZ9tzQ#gid=2074850979" target="_blank" rel="noopener">a Google Spreadsheet that is open to the public</a>. Most of the GitHub code repositories tracked by this group include relatively harmless components that will either display a simple message in support of Ukraine, or show statistics about the war in Ukraine &#8212; such as casualty numbers &#8212; and links to more information on the Deep Web.</p>
<p>For example, the popular library <strong>ES5-ext</strong> hadn&#8217;t updated its code in nearly two years. But on March 7, the code project added a component &#8220;<a href="https://github.com/medikoo/es5-ext/commit/28de285ed433b45113f01e4ce7c74e9a356b2af2" target="_blank" rel="noopener">postinstall.js</a>,&#8221; which checks to see if the user&#8217;s computer is tied to a Russian Internet address. If so, the code broadcasts a &#8220;Call for peace:&#8221;</p>
<div id="attachment_58971" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58971" loading="lazy" class="wp-image-58971" src="media/3912a029.callforpeace.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/callforpeace.png" alt="" width="750" height="685" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/callforpeace.png 799w, https://krebsonsecurity.com/wp-content/uploads/2022/03/callforpeace-768x702.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/callforpeace-782x714.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-58971" class="wp-caption-text">A message that appears for Russian users of the popular es5-ext code library on GitHub. The message has been Google-Translated from Russian to English.</p></div>
<p>A more concerning example can be found at the GitHub page for &#8220;<strong>vue-cli</strong>,&#8221; a popular Javascript framework for building web-based user interfaces. On March 15, users discovered <a href="https://github.com/vuejs/vue-cli/issues/7054" target="_blank" rel="noopener">a new component had been added</a> that was designed to wipe all files from any systems visiting from a Russian or Belarusian Internet address (the malicious code has since been removed):</p>
<div id="attachment_58974" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58974" loading="lazy" class=" wp-image-58974" src="media/63369311.vue-cli.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/vue-cli.png" alt="" width="751" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/vue-cli.png 789w, https://krebsonsecurity.com/wp-content/uploads/2022/03/vue-cli-768x503.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/vue-cli-782x512.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-58974" class="wp-caption-text">Readers complaining that an update to the popular Vue-Cli package sought to wipe files if the user was coming from a Russian IP address.</p></div>
<p>&#8220;Man, I love politics in my APIs,&#8221; GitHub user &#8220;<strong>MSchleckser</strong>&#8221; commented wryly on Mar. 15.<span id="more-58969"></span></p>
<p>The crowdsourced effort also blacklisted a code library called &#8220;<a href="https://github.com/RIAEvangelist/peacenotwar" target="_blank" rel="noopener">PeaceNotWar</a>&#8221; maintained by GitHub user <strong>RIAEvangelist</strong>.</p>
<p>&#8220;This code serves as a non-destructive example of why controlling your node modules is important,&#8221; RIAEvangelist wrote. &#8220;It also serves as a non-violent protest against Russia&#8217;s aggression that threatens the world right now. This module will add a message of peace on your users&#8217; desktops, and it will only do it if it does not already exist just to be polite. To include this module in your code, just run npm i peacenotwar in your code&#8217;s directory or module root.&#8221;</p>
<p><strong>Alex Holden</strong> is a native Ukrainian who runs the Minneapolis-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>. Holden said the real trouble starts when protestware is included in code packages that get automatically fetched by a myriad of third-party software products. Holden said some of the code projects tracked by the Russian research group are maintained by Ukrainian software developers.</p>
<p>&#8220;Ukrainian and sadly non-Ukrainian developers are modifying their public software to trigger malware or pro-Ukraine ads when deployed on Russian computers,&#8221; Holden said. &#8220;And we see this effort, which is the Russians trying to defend against that.&#8221;</p>
<p>Commenting on the malicious code added to the &#8220;Vue-cli&#8221; application, GitHub user &#8220;<strong>nm17</strong>&#8221; said a continued expansion of protestware would erode public trust in open-source software.</p>
<p>&#8220;The Pandora&#8217;s box is now opened, and from this point on, people who use opensource will experience xenophobia more than ever before, EVERYONE included,&#8221; NM17 wrote. &#8220;The trust factor of open source, which was based on good will of the developers is now practically gone, and now, more and more people are realizing that one day, their library/application can possibly be exploited to do/say whatever some random dev on the internet thought &#8216;was the right thing they to do.&#8217; Not a single good came out of this &#8216;protest.'&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=58914
title: ‘Spam Nation’ Villain Vrublevsky Charged With Fraud
uri: Spam-Nation-Villain-Vrublevsky-Charged-With-Fraud
url: https://krebsonsecurity.com/2022/03/spam-nation-villain-vrublevsky-charged-with-fraud/
content:
<p><strong>Pavel Vrublevsky</strong>, founder of the Russian payment technology firm <strong>ChronoPay</strong> and the antagonist in my 2014 book &#8220;<a href="https://www.amazon.com/dp/B00L5QGBL0/ref=dp-kindle-redirect?_encoding=UTF8&amp;btkr=1" target="_blank" rel="noopener">Spam Nation</a>,&#8221; was arrested in Moscow this month and charged with fraud. Russian authorities allege Vrublevsky operated several fraudulent SMS-based payment schemes, and facilitated money laundering for <strong>Hydra</strong>, the largest Russian darknet market. But according to information obtained by KrebsOnSecurity, it is equally likely Vrublevsky was arrested thanks to his propensity for carefully documenting the links between Russia&#8217;s state security services and the cybercriminal underground.</p>
<div id="attachment_10429" style="width: 713px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-10429" class="size-full wp-image-10429" src="media/4ec584cd.Pavelpic.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/06/Pavelpic.jpg" alt="" width="703" height="487" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/06/Pavelpic.jpg 703w, https://krebsonsecurity.com/wp-content/uploads/2011/06/Pavelpic-300x207.jpg 300w" sizes="(max-width: 703px) 100vw, 703px" /><p id="caption-attachment-10429" class="wp-caption-text">An undated photo of Vrublevsky at his ChronoPay office in Moscow.</p></div>
<p>ChronoPay specializes in providing access to the global credit card networks for &#8220;high risk&#8221; merchants &#8212; businesses involved in selling services online that tend to generate an unusually large number of chargebacks and reports of fraud, and hence have a higher risk of failure.</p>
<p>When I first began writing about Vrublevsky <a href="http://voices.washingtonpost.com/securityfix/2009/07/following_the_money_trail_of_r.html" target="_blank" rel="noopener">in 2009 as a reporter for The Washington Post</a>, ChronoPay and its sister firm <strong>Red &amp; Partners</strong> (RNP) were earning millions setting up payment infrastructure <a href="https://krebsonsecurity.com/2011/03/chronopays-scareware-diaries/" target="_blank" rel="noopener">for fake antivirus peddlers</a> and <a href="https://krebsonsecurity.com/2011/02/russian-cops-crash-pill-pusher-party/" target="_blank" rel="noopener">spammers pimping male enhancement drugs</a>.</p>
<p>Using the hacker alias &#8220;<strong>RedEye</strong>,&#8221; the ChronoPay CEO oversaw a burgeoning pharmacy spam affiliate program called <a href="https://krebsonsecurity.com/?s=rx-promotion" target="_blank" rel="noopener">Rx-Promotion</a>, which paid some of Russia&#8217;s most talented spammers and virus writers to bombard the world with junk email promoting Rx-Promotion&#8217;s pill shops. RedEye also was the administrator of <strong>Crutop</strong>, a Russian language forum and affiliate program that catered to thousands of adult webmasters.</p>
<p>In 2013, Vrublevsky was <a href="https://krebsonsecurity.com/2013/08/pavel-vrublevsky-sentenced-to-2-5-years/" target="_blank" rel="noopener">sentenced to 2.5 years in a Russian penal colony</a> for convincing one of his top affiliates to launch a distributed denial-of-service (DDoS) attack against a competitor that shut down the ticketing system for the state-owned <strong>Aeroflot</strong> airline.</p>
<p>Following his release from jail, Vrublevsky began working on a new digital payments platform based in Hong Kong called <strong>HPay Ltd</strong> (a.k.a. Hong Kong Processing Corporation). HPay appears to have had a great number of clients that were running schemes which bamboozled people with fake lotteries and prize contests.</p>
<p>According to Russian prosecutors, the scam went like this: Consumers would receive an SMS with links to sites that falsely claimed a number of well-known companies were sponsoring drawings and lotteries for people who enrolled or agreed to answer surveys. All who responded were told they were winners, but also that they had to pay a commission to pick up the prize. That scheme allegedly stole 500 million rubles (~ USD $4.5 million) from over 100,000 consumers.</p>
<p>There are scant public records that show a connection between ChronoPay and HPay, apart from the fact that the latter&#8217;s website &#8212; hpay[.]io &#8212; was originally hosted on the same server (185.111.218.63) along with a handful of other domains, including Vrublevsky&#8217;s personal website <strong>rnp[.]com</strong>.</p>
<p>But then earlier this month, KrebsOnSecurity received a large amount of information that was stolen from ChronoPay recently when hackers managed to compromise the company&#8217;s <strong>Confluence</strong> server. Confluence is a web-based corporate wiki platform, and ChronoPay used their Confluence installation to document in exquisite detail how it creatively distributes the risk associated with high-risk processing by routing transactions through a myriad of shell companies and third-party processors.</p>
<div id="attachment_59012" style="width: 769px" class="wp-caption aligncenter"><a href="media/13e33d87.cc-tacticaldata.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-tacticaldata.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59012" loading="lazy" class="wp-image-59012" src="media/13e33d87.cc-tacticaldata.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-tacticaldata.png" alt="" width="759" height="321" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-tacticaldata.png 1565w, https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-tacticaldata-768x325.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-tacticaldata-1536x650.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-tacticaldata-782x331.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></a><p id="caption-attachment-59012" class="wp-caption-text">A Google-translated snippet of the hacked ChronoPay Confluence installation. Click to enlarge.</p></div>
<p>Incredibly, Vrublevsky himself appears to have used ChronoPay&#8217;s Confluence wiki to document his entire 20+ years of personal and professional history in the high-risk payments space, including the company&#8217;s most recent forays with HPay. The latest document in the hacked archive is dated April 2021.</p>
<p>These diary entries, interspersed between highly technical how-tos, are all written in Russian and in the third person. But they are unmistakably Vrublevsky&#8217;s words: Some of the elaborate stories in the wiki were identical to theories that Vrublevsky himself espoused to me throughout hundreds of hours of phone interviews. Also, in some of the entries the narrator switches from &#8220;he&#8221; to &#8220;I&#8221; when describing the actions of Vrublevsky.</p>
<p>Vrublevsky&#8217;s memoire/wiki invokes the nicknames and real names of Russian hackers who worked with the protection of corrupt officials in the Russian <strong>Federal Security Service</strong> (FSB), the successor agency to the Soviet KGB. In several diary entries, Vrublevsky writes about various cybercriminals and Russian law enforcement officials involved in processing credit card payments tied to online gambling sites.</p>
<p>Russian banks are prohibited from processing payments for online gambling, and as a result many online gaming sites catering to Russian speakers have chosen to process credit card payments through Ukrainian financial institutions.</p>
<p>That&#8217;s according to <strong>Vladislav &#8220;BadB&#8221; Horohorin</strong>, the convicted cybercriminal who shared the ChronoPay Confluence data with KrebsOnSecurity. In February 2017, Horohorin was released after serving four years in a U.S. prison for his role in the <a href="https://en.wikipedia.org/wiki/Vladislav_Horohorin" target="_blank" rel="noopener">2009 theft of more than $9 million from RBS Worldpay</a>.</p>
<p>Horohorin said Vrublevsky has been using his knowledge of the card processing networks to extort people in the online gambling industry who may run afoul of Russian laws.</p>
<p>&#8220;Russia has strict regulations against processing for the gambling business,&#8221; Horohorin said. &#8220;While Russian banks can&#8217;t do it, Ukrainian ones can, so we have Ukrainian banks processing gambling and casinos, which mostly Russian gamblers use. What Pavel does is he blackmails those Ukrainian banks using his connections and knowledge. Some pay, some don&#8217;t. But some people are not very tolerant of that kind of abuse.&#8221;</p>
<p>A native of Donetsk, Ukraine, Horohorin told KrebsOnSecurity he hacked and shared the ChronoPay Confluence installation because Vrublevsky had threatened a family member. Horohorin believes Vrublevsky secretly operated the &#8220;<strong>bad bank</strong>&#8221; channel on Telegram, which calls attention to online gambling operations that are violating Visa and MasterCard regulations (violations that can bring the violator hundreds of thousands of dollars in fines).</p>
<p>&#8220;Pavel scrupulously wrote his diary for a long time, and there is a lot of information on the people he knows,&#8221; Horohorin told KrebsOnSecurity. &#8220;My understanding is he wrote this in order to blackmail people later. There is a lot of interesting stuff, a lot of names and a lot of very intimate info about Russian card processing market, as well as Pavel&#8217;s own escapades.&#8221;</p>
<div id="attachment_59013" style="width: 683px" class="wp-caption aligncenter"><a href="media/d41dfecc.cc-gambling.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-gambling.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59013" loading="lazy" class="wp-image-59013 size-full" src="media/d41dfecc.cc-gambling.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/cc-gambling.png" alt="" width="673" height="808" /></a><p id="caption-attachment-59013" class="wp-caption-text">ChronoPay&#8217;s hacked Confluence server contains many diary entries about major players in the Russian online gambling and bookmaking industries.</p></div>
<p>Among the escapades recounted in the ChronoPay founder&#8217;s diaries are multiple stories involving the self-proclaimed &#8220;King of Fraud!&#8221; <strong>Aleksandr &#8220;Nastra&#8221; Zhukov</strong>, a Russian national who ran an advertising fraud network dubbed &#8220;<a href="https://krebsonsecurity.com/2016/12/report-3-5m-in-ad-fraud-daily-from-methbot/" target="_blank" rel="noopener">Methbot</a>&#8221; that stole $7 million from publishers through bots made to look like humans watching videos online.</p>
<p>The journal explains that Zhukov lived with a ChronoPay employee and had a great deal of interaction with ChronoPay&#8217;s high-risk department, so much so that Zhukov at one point gave Vrublevsky a $100,000 jeweled watch as a gift. Zukhov was arrested in Bulgaria in 2018 and extradited to the United States. Following a jury trial in New York that ended last year, Zhukov was <a href="https://www.justice.gov/usao-edny/pr/russian-cybercriminal-sentenced-10-years-prison-digital-advertising-fraud-scheme" target="_blank" rel="noopener">sentenced to 10 years in prison</a>.</p>
<p>According to the Russian news outlet <em>Kommersant</em>, Vrublevsky and company operated &#8220;<strong>Inferno Pay</strong>,&#8221; a payments portal that worked with Hydra, the largest Russian darknet market for illicit goods, including drug trafficking, malware, and counterfeit money and documents.</p>
<div id="attachment_59015" style="width: 765px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59015" loading="lazy" class=" wp-image-59015" src="media/9acdfe46.infernopay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infernopay.png" alt="" width="755" height="430" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/infernopay.png 1140w, https://krebsonsecurity.com/wp-content/uploads/2022/03/infernopay-768x437.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/infernopay-782x445.png 782w" sizes="(max-width: 755px) 100vw, 755px" /><p id="caption-attachment-59015" class="wp-caption-text">Inferno Pay, a cryptocurrency and payment API allegedly operated by the ChronoPay CEO.</p></div>
<p>&#8220;The services of Inferno Pay, whose commission came to 30% of the transaction, were actively used by online casinos,&#8221; Kommersant <a href="https://www.kommersant.ru/doc/5251902" target="_blank" rel="noopener">wrote on Mar. 12</a>.</p>
<p>The drama surrounding Vrublevsky&#8217;s most recent arrest is reminiscent of events leading up to his imprisonment nearly a decade ago, when <a href="https://krebsonsecurity.com/2011/06/organization-chart-reveals-chronopay%e2%80%99s-links-to-shady-internet-projects/" target="_blank" rel="noopener">several years&#8217; worth of ChronoPay internal emails were leaked online</a>.</p>
<p>Kommersant said Russian authorities also searched the dwelling of <strong>Dmitry Artimovich</strong>, a former ChronoPay director who along with his brother <strong>Igor</strong> was responsible for <a href="https://krebsonsecurity.com/2012/06/who-is-the-festi-botmaster/" target="_blank" rel="noopener">running the Festi botnet</a>, the same spam botnet that was used for years to pump out junk emails promoting Vrublevsky&#8217;s pharmacy affiliate websites. Festi also was the botnet used in the DDoS attack that sent Vrubelvsky to prison for two years in 2013.</p>
<p>Artimovich says he had a falling out with Vrublevsky roughly five years ago, and he&#8217;s been suing the company ever since. In a message to KrebsOnSecurity, Artimovich said while Vrublevsky was involved in a lot of shady activities, he doubts Vrublevksy&#8217;s arrest was really about SMS payment scams as the government claims.</p>
<p>&#8220;I do not think that it was a reason for his arrest,&#8221; Artimovich said. &#8220;O<span lang="en">ur law enforcement usually don&#8217;t give a shit about sites like this. And I don&#8217;t think that Vrublevsky made much money there. </span><span lang="en">I believe he angered some high-ranking person. Because the scale of the case is much larger than Aeroflot. Police made </span><span lang="en">search of 22 people. Illegal seizure of money, computers.&#8221;</span></p>
<div id="attachment_59029" style="width: 702px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59029" loading="lazy" class="wp-image-59029 size-full" src="media/be1dce33.hydramarket.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/hydramarket.png" alt="" width="692" height="670" /><p id="caption-attachment-59029" class="wp-caption-text">The Hydra darknet market. Image: bitcoin.com</p></div>


feed_id: https://krebsonsecurity.com/?p=59041
title: A Closer Look at the LAPSUS$ Data Extortion Group
uri: A-Closer-Look-at-the-LAPSUS-Data-Extortion-Group
url: https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/
content:
<p><strong>Microsoft </strong>and identity management platform <strong>Okta</strong> both this week disclosed breaches involving <strong>LAPSUS$</strong>, a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here&#8217;s a closer look at LAPSUS$, and some of the low-tech but high-impact methods the group uses to gain access to targeted organizations.</p>
<p>First surfacing in December 2021 with an extortion demand on Brazil&#8217;s Ministry of Health, LAPSUS$ made headlines more recently for posting screenshots of internal tools tied to a number of major corporations, including <strong>NVIDIA, Samsung, and Vodafone.</strong></p>
<p>On Tuesday, LAPSUS$ announced via its Telegram channel it was releasing source code stolen from Microsoft. In <a href="https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/" target="_blank" rel="noopener">a blog post</a> published Mar. 22, Microsoft said it interrupted the LAPSUS$ group&#8217;s source code download before it could finish, and that it was able to do so because LAPSUS$ publicly discussed their illicit access on their Telegram channel before the download could complete.</p>
<div id="attachment_59043" style="width: 1069px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59043" class="size-full wp-image-59043" src="media/515cc1db.lapsuss-died.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsuss-died.png" alt="" width="1059" height="238" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsuss-died.png 1059w, https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsuss-died-768x173.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsuss-died-782x176.png 782w" sizes="(max-width: 1059px) 100vw, 1059px" /><p id="caption-attachment-59043" class="wp-caption-text">One of the LAPSUS$ group members admitted on their Telegram channel that the Microsoft source code download had been interrupted.</p></div>
<p>&#8220;This public disclosure escalated our action allowing our team to intervene and interrupt the actor mid-operation, limiting broader impact,&#8221; Microsoft wrote. &#8220;No customer code or data was involved in the observed activities. Our investigation has found a single account had been compromised, granting limited access. Microsoft does not rely on the secrecy of code as a security measure and viewing source code does not lead to elevation of risk.&#8221;</p>
<p>While it may be tempting to dismiss LAPSUS$ as an immature and fame-seeking group, their tactics should make anyone in charge of corporate security sit up and take notice. Microsoft says LAPSUS$ &#8212; which it boringly calls &#8220;DEV-0537&#8221; &#8212; mostly gains illicit access to targets via &#8220;social engineering.&#8221; This involves bribing or tricking employees at the target organization or at its myriad partners, such as customer support call centers and help desks.</p>
<p>&#8220;Microsoft found instances where the group successfully gained access to target organizations through recruited employees (or employees of their suppliers or business partners),&#8221; Microsoft wrote. The post continues:</p>
<blockquote><p>&#8220;DEV-0537 advertised that they wanted to buy credentials for their targets to entice employees or contractors to take part in its operation. For a fee, the willing accomplice must provide their credentials and approve the MFA prompt or have the user install AnyDesk or other remote management software on a corporate workstation allowing the actor to take control of an authenticated system. Such a tactic was just one of the ways DEV-0537 took advantage of the security access and business relationships their target organizations have with their service providers and supply chains.&#8221;</p></blockquote>
<p>The LAPSUS$ Telegram channel has grown to more than 45,000 subscribers, and Microsoft points to an ad that LAPSUS$ posted there offering to recruit insiders at major mobile phone providers, large software and gaming companies, hosting firms and call centers.</p>
<p>Sources tell KrebsOnSecurity that LAPSUS$ has been recruiting insiders via multiple social media platforms since at least November 2021. One of the core LAPSUS$ members who used the nicknames &#8220;Oklaqq&#8221; and &#8220;WhiteDoxbin&#8221; <a href="https://camas.github.io/reddit-search/#{%22author%22:%22oklaqq%22,%22searchFor%22:1,%22resultSize%22:100}" target="_blank" rel="noopener">posted multiple recruitment messages to Reddit last year</a>, offering employees at AT&amp;T, T-Mobile and Verizon up to $20,000 a week to perform &#8220;inside jobs.&#8221;</p>
<div id="attachment_59044" style="width: 1033px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59044" loading="lazy" class="size-full wp-image-59044" src="media/b1f7e8c3.white-oklaqq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/white-oklaqq.png" alt="" width="1023" height="392" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/white-oklaqq.png 1023w, https://krebsonsecurity.com/wp-content/uploads/2022/03/white-oklaqq-768x294.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/white-oklaqq-782x300.png 782w" sizes="(max-width: 1023px) 100vw, 1023px" /><p id="caption-attachment-59044" class="wp-caption-text">LAPSUS$ leader Oklaqq a.k.a. &#8220;WhiteDoxbin&#8221; offering to pay $20,000 a week to corrupt employees at major mobile providers.</p></div>
<p>Many of LAPSUS$&#8217;s recruitment ads are written in both English and Portuguese. According to cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, the bulk of the group&#8217;s victims (15 of them) have been in Latin America and Portugal.</p>
<p>&#8220;LAPSUS$ currently does not operate a clearnet or darknet leak site or traditional social media accounts—it operates solely via Telegram and email,&#8221; Flashpoint wrote in an analysis of the group. &#8220;LAPSUS$ appears to be highly sophisticated, carrying out increasingly high-profile data breaches. The group has claimed it is not state-sponsored. The individuals behind the group are likely experienced and have demonstrated in-depth technical knowledge and abilities.&#8221;</p>
<p>Microsoft said LAPSUS$ has been known to target the personal email accounts of employees at organizations they wish to hack, knowing that most employees these days use some sort of VPN to remotely access their employer&#8217;s network.</p>
<p>&#8220;In some cases, [LAPSUS$] first targeted and compromised an individual’s personal or private (non-work-related) accounts giving them access to then look for additional credentials that could be used to gain access to corporate systems,&#8221; Microsoft wrote. &#8220;Given that employees typically use these personal accounts or numbers as their second-factor authentication or password recovery, the group would often use this access to reset passwords and complete account recovery actions.&#8221;</p>
<p>In other cases, Microsoft said, LAPSUS$ has been seen calling a target organization&#8217;s help desk and attempting to convince support personnel to reset a privileged account&#8217;s credentials.</p>
<p>&#8220;The group used the previously gathered information (for example, profile pictures) and had a native-English-sounding caller speak with the help desk personnel to enhance their social engineering lure,&#8221; Microsoft explained. &#8220;Observed actions have included DEV-0537 answering common recovery prompts such as “first street you lived on” or “mother’s maiden name” to convince help desk personnel of authenticity. Since many organizations outsource their help desk support, this tactic attempts to exploit those supply chain relationships, especially where organizations give their help desk personnel the ability to elevate privileges.&#8221;</p>
<div id="attachment_59048" style="width: 766px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59048" loading="lazy" class=" wp-image-59048" src="media/8823f5ab.lapsussjobs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsussjobs.png" alt="" width="756" height="681" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsussjobs.png 812w, https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsussjobs-768x691.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/lapsussjobs-782x704.png 782w" sizes="(max-width: 756px) 100vw, 756px" /><p id="caption-attachment-59048" class="wp-caption-text">LAPSUS$ recruiting insiders via its Telegram channel.</p></div>
<p><span id="more-59041"></span></p>
<h2>SIM-SWAPPING PAST SECURITY</h2>
<p>Microsoft said LAPSUS$ also has used &#8220;<a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">SIM swapping</a>&#8221; to gain access to key accounts at target organizations. In a fraudulent SIM swap, the attackers bribe or trick mobile company employees into transferring a target’s mobile phone number to their device. From there, the attackers can intercept any one-time passwords sent to the victim via SMS or phone call. They can also then reset the password for any online account that allows password resets via a link sent over SMS.</p>
<p>&#8220;Their tactics include phone-based social engineering; SIM-swapping to facilitate account takeover; accessing personal email accounts of employees at target organizations; paying employees, suppliers, or business partners of target organizations for access to credentials and multifactor authentication (MFA) approval; and intruding in the ongoing crisis-communication calls of their targets,&#8221; Microsoft wrote.</p>
<p><strong>Allison Nixon</strong> is chief research officer at <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a>, a cybersecurity consultancy based in New York that closely tracks cybercriminals involved in SIM-swapping. Working with researchers at security firm <strong>Palo Alto Networks</strong>, Nixon has been tracking individual members of LAPSUS$ prior to their forming the group, and says the social engineering techniques adopted by the group have long been abused to target employees and contractors working for the major mobile phone companies.</p>
<p>&#8220;LAPSUS$ may be the first to make it extremely obvious to the rest of the world that there are a lot of soft targets that are not telcos,&#8221; Nixon said. &#8220;The world is full of targets that are not used to being targeted this way.&#8221;</p>
<p>Microsoft says LAPSUS$ also has been known to gain access to victim organizations by deploying the &#8220;Redline&#8221; password-stealing malware, searching public code repositories for exposed passwords, and purchasing credentials and session tokens from criminal forums.</p>
<p>That last bit is interesting because Nixon said it appears LAPSUS$ also was involved in the intrusion at game maker <strong>Electronic Arts </strong>(EA) last year, in which extortionists demanded $28 million in exchange for a promise not to publish 780 GB worth of source code. In an interview with <em>Motherboard</em>, the hackers claimed to have gained access to EA&#8217;s data after purchasing authentication cookies for an EA Slack channel from a dark web marketplace called <a href="https://krebsonsecurity.com/2022/01/crime-shop-sells-hacked-logins-to-other-crime-shops/" target="_blank" rel="noopener">Genesis</a>.</p>
<p>&#8220;The hackers said they used the authentication cookies to mimic an already-logged-in EA employee’s account and access EA’s Slack channel and then trick an EA IT support staffer into granting them access to the company’s internal network,&#8221; <a href="https://therecord.media/hackers-leak-full-ea-data-after-failed-extortion-attempt/" target="_blank" rel="noopener">wrote</a> <strong>Catalin Cimpanu</strong> for <em>The Record</em>.</p>
<p>Why is Nixon convinced LAPSUS$ was behind the EA attack? The &#8220;WhiteDoxbin/Oklaqq&#8221; identity referenced in the first insider recruitment screenshot above appears to be the group&#8217;s leader, and it has used multiple nicknames across many Telegram channels. However, Telegram lumps all aliases for an account into the same Telegram ID number.</p>
<p>Back in May 2021, WhiteDoxbin&#8217;s Telegram ID was used to create an account on a Telegram-based service for launching distributed denial-of-service (DDoS) attacks, where they introduced themself as &#8220;@<strong>breachbase</strong>.&#8221; News of EA&#8217;s hack last year was first posted to the cybercriminal underground by the user &#8220;Breachbase&#8221; on the English-language hacker community <strong>RaidForums</strong>, which was recently seized by the FBI.</p>
<h2>WHO IS LAPSUS$?</h2>
<p>Nixon said WhiteDoxbin &#8212; LAPSUS$&#8217;s apparent ringleader &#8212; is the same individual who last year purchased the <strong>Doxbin</strong>, a long-running, text-based website where anyone can post the personal information of a target, or find personal data on hundreds of thousands who have already been &#8220;doxed.&#8221;</p>
<p>Apparently, Doxbin&#8217;s new owner failed to keep the site functioning smoothly, because top Doxbin members had no problems telling WhiteDoxbin how unhappy they were with his stewardship.</p>
<p>&#8220;He wasn&#8217;t a good administrator, and couldn&#8217;t keep the website running properly,&#8221; Nixon said. &#8220;The Doxbin community was pretty upset, so they started targeting him and harassing him.&#8221;</p>
<p>Nixon said that in January 2022, WhiteDoxbin reluctantly agreed to relinquish control over Doxbin, selling the forum back to its previous owner at a considerable loss. However, just before giving up the forum, WhiteDoxbin leaked the entire Doxbin data set (including private doxes that had remain unpublished on the site as drafts) to the public via Telegram.</p>
<p>The Doxbin community responded ferociously, posting on WhiteDoxbin perhaps the most thorough dox the community had ever produced, including videos supposedly shot at night outside his home in the United Kingdom.</p>
<p>According to the denizens of Doxbin, WhiteDoxbin started out in the business of buying and selling zero-day vulnerabilities, security flaws in popular software and hardware that even the makers of those products don&#8217;t yet know about.</p>
<p>&#8220;[He] slowly began making money to further expand his exploit collection,&#8221; reads his Doxbin entry. &#8220;After a few years his net worth accumulated to well over 300BTC (close to $14 mil).&#8221;</p>
<p>WhiteDoxbin&#8217;s Breachbase identity on RaidForums at one point in 2020 said they had a budget of $1 million in bitcoin with which to buy zero-day flaws in Github, Gitlab, Twitter, Snapchat, Cisco VPN, Pulse VPN and other remote access or collaboration tools.</p>
<p>&#8220;My budget is $100000 in BTC,&#8221; Breachbase told Raidforums in October 2020. &#8220;Person who directs me to someone will get $10000 BTC. Reply to thread if you know anyone or anywhere selling this stuff. NOTE: The 0day must have high/critical impact.&#8221;</p>
<p>KrebsOnSecurity is not publishing WhiteDoxbin&#8217;s alleged real name because he is a minor (currently aged 17), and because this person has not officially been accused of a crime. Also, the Doxbin entry for this individual includes personal information on his family members.</p>
<p>Nixon said that prior to launching LAPSUS$, WhiteDoxbin was a founding member of a cybercriminal group calling itself the &#8220;<a href="https://web.archive.org/web/20210410013319/http://recursion.team/" target="_blank" rel="noopener">Recursion Team.</a>&#8221; According to the group&#8217;s now-defunct website, they mostly specialized in SIM swapping targets of interest and participating in <a href="https://krebsonsecurity.com/?s=swatting" target="_blank" rel="noopener">&#8220;swatting&#8221; attacks</a>, wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address.</p>
<p>&#8220;The team is made up of Cyber-enthusiasts who major in skills including security penetration, software development, and botting,&#8221; reads the now-defunct Recursion Team website. &#8220;We plan to have a bright future, and we hope you do too!&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=59083
title: Estonian Tied to 13 Ransomware Attacks Gets 66 Months in Prison
uri: Estonian-Tied-to-13-Ransomware-Attacks-Gets-66-Months-in-Prison
url:
https://krebsonsecurity.com/2022/03/estonian-tied-to-13-ransomware-attacks-gets-66-months-in-prison/

content:
<p>An Estonian man was sentenced today to more than five years in a U.S. prison for his role in at least 13 ransomware attacks that caused losses of approximately $53 million. Prosecutors say the accused also enjoyed a lengthy career of &#8220;cashing out&#8221; access to hacked bank accounts worldwide.</p>
<p><img class="aligncenter wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="752" height="563" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 752px) 100vw, 752px" /></p>
<p><strong>Maksim Berezan</strong>, 37, is an Estonian national who was arrested nearly two years ago in Latvia. U.S. authorities alleged Berezan was a longtime member of <strong>DirectConnection</strong>, a closely-guarded Russian cybercriminal forum that existed until 2015. Berezan&#8217;s <a href="media/b6ca241f.berezanindict.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/berezanindict.pdf" target="_blank" rel="noopener">indictment</a> (PDF) says he used his status at DirectConnection to secure cashout jobs from other vetted crooks on the exclusive crime forum.</p>
<p>Berezan specialized in cashouts and &#8220;drops.&#8221; Cashouts refer to using stolen payment card data to make fraudulent purchases or to withdraw money from bank accounts without authorization. A drop is a location or individual able to securely receive and forward funds or goods obtained through cashouts or other types of fraud. Drops typically are used to make it harder for law enforcement to trace fraudulent transactions and to circumvent fraud detection measures used by banks and credit card companies.</p>
<p>Acting on information from U.S. authorities, in November 2020 Latvian police searched Berezan&#8217;s residence there and found a red Porsche Carrera 911, a black Porsche Cayenne, a Ducati motorcycle, and an assortment of jewelry. They also seized $200,000 in currency, and $1.7 million in bitcoin.</p>
<p>After Berezan was extradited to the United States in December 2020, investigators searching his electronic devices said they found &#8220;significant evidence of his involvement in ransomware activity.&#8221;</p>
<p>&#8220;The post-extradition investigation determined that Berezan had participated in at least 13 ransomware attacks, 7 of which were against U.S. victims, and that approximately $11 million in ransom payments flowed into cryptocurrency wallets that he controlled,&#8221; reads <a href="https://www.justice.gov/usao-edva/pr/cybercriminal-connected-multimillion-dollar-ransomware-attacks-sentenced-online-fraud" target="_blank" rel="noopener">a statement</a> from the <strong>U.S. Department of Justice</strong>.</p>
<p>Berezan pleaded guilty in April 2021 to conspiracy to commit wire fraud.<span id="more-59083"></span></p>
<div id="attachment_49556" style="width: 769px" class="wp-caption aligncenter"><a href="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-49556" loading="lazy" class="wp-image-49556" src="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png" alt="" width="759" height="274" /></a><p id="caption-attachment-49556" class="wp-caption-text">The DirectConnection cybercrime forum, circa 2011.</p></div>
<p>For many years on DirectConnection and other crime forums, Berezan went by the hacker alias &#8220;<strong>Albanec</strong>.&#8221; Investigators close to the case told KrebsOnSecurity that Albanec was involved in multiple so-called <a href="https://krebsonsecurity.com/2018/08/fbi-warns-of-unlimited-atm-cashout-blitz/" target="_blank" rel="noopener">&#8220;unlimited&#8221; cashouts</a>, a highly choreographed, global fraud scheme in which crooks hack a bank or payment card processor and used cloned payment cards at cash machines around the world to fraudulently withdraw millions of dollars in just a few hours.</p>
<p>Berezan joins a growing list of top cybercriminals from DirectConnection who&#8217;ve been arrested and convicted of cybercrimes since the forum disappeared years ago. One of Albanec&#8217;s business partners on the forum was <strong>Sergey &#8220;Flycracker&#8221; Vovnenko</strong>, a Ukrainian man who once ran his own cybercrime forum and who in 2013 <a href="https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/" target="_blank" rel="noopener">executed a plot to have heroin delivered to our home</a> in a bid to get Yours Truly arrested for drug possession. Vovnenko was later arrested, extradited to the United States, pleaded guilty and spent more than three years in prison on botnet-related charges (Vovnenko is now back in Ukraine, trying to <a href="https://krebsonsecurity.com/2022/03/internet-backbone-giant-lumen-shuns-ru/" target="_blank" rel="noopener">fight the Russian invasion with his hacking abilities</a>).</p>
<p>Perhaps the most famous DirectConnection member was its administrator <strong>Aleksei Burkov</strong>, a Russian hacker thought to be so connected to the Russian cybercriminal scene that he was described as an &#8220;asset of extreme importance to Moscow.&#8221; Burkov was arrested in Israel in 2015, and the Kremlin <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener">arrested an Israeli woman on trumped-up drug charges to force a prisoner swap</a>.</p>
<p>That effort failed. Burkov was extradited to the U.S. in 2019, soon <a href="https://krebsonsecurity.com/2020/01/russian-cybercrime-boss-burkov-pleads-guilty/" target="_blank" rel="noopener">pleaded guilty</a>, and was <a href="https://krebsonsecurity.com/2020/06/russian-cybercrime-boss-burkov-gets-9-years/" target="_blank" rel="noopener">sentenced to nine years</a>. However, he was recently deported back to Russia prior to serving his full sentence, which has <a href="https://krebsonsecurity.com/2022/03/lawmakers-probe-early-release-of-top-ru-cybercrook/" target="_blank" rel="noopener">prompted Republican leaders in the House to question why</a>.</p>
<p>Other notable cybercrooks from DirectConnection who&#8217;ve been arrested, extradited to the U.S. and sentenced to prison include convicted credit card fraudsters <a href="https://www.wired.com/2010/08/badb-rbs-worldpay-hack/" target="_blank" rel="noopener">Vladislav “Badb” Horohorin</a> and <a href="https://krebsonsecurity.com/?s=zo0mer&amp;x=0&amp;y=0" target="_blank" rel="noopener">Sergey “zo0mer” Kozerev</a>, as well as the infamous spammer and botnet master <a href="https://krebsonsecurity.com/?s=severa+waledac&amp;x=0&amp;y=0" target="_blank" rel="noopener">Peter “Severa” Levashov</a>.</p>
<p>At his sentencing today, Berezan was sentenced to 66 months in prison and ordered to pay $36 million in restitution to his victims. A source close to the investigation said Berezan&#8217;s sentence likely would have been far more severe had he not entered into a cooperation agreement to share useful information with U.S. authorities.</p>


feed_id: https://krebsonsecurity.com/?p=59088
title: Hackers Gaining Power of Subpoena Via Fake “Emergency Data Requests”
uri: 2022-03-29-
url:
https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/

content:
<p>There is a terrifying and highly effective &#8220;method&#8221; that criminal hackers are now using to harvest sensitive customer data from Internet service providers, phone companies and social media firms. It involves compromising email accounts and websites tied to police departments and government agencies, and then sending unauthorized demands for subscriber data while claiming the information being requested can&#8217;t wait for a court order because it relates to an urgent matter of life and death.</p>
<p><img class="aligncenter wp-image-59128" src="media/b7372c46.legalrequest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png" alt="" width="764" height="635" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-782x650.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></p>
<p>In the United States, when federal, state or local law enforcement agencies wish to obtain information about who owns an account at a social media firm, or what Internet addresses a specific cell phone account has used in the past, they must submit an official court-ordered warrant or subpoena.</p>
<p>Virtually all major technology companies serving large numbers of users online have departments that routinely review and process such requests, which are typically granted as long as the proper documents are provided and the request appears to come from an email address connected to an actual police department domain name.</p>
<p>But in certain circumstances &#8212; such as a case involving imminent harm or death &#8212; an investigating authority may make what&#8217;s known as an <strong>Emergency Data Request</strong> (EDR), which largely bypasses any official review and does not require the requestor to supply any court-approved documents.</p>
<p>It is now clear that some hackers have figured out there is no quick and easy way for a company that receives one of these EDRs to know whether it is legitimate. Using their illicit access to police email systems, the hackers will send a fake EDR along with an attestation that innocent people will likely suffer greatly or die unless the requested data is provided immediately.</p>
<p>In this scenario, the receiving company finds itself caught between two unsavory outcomes: Failing to immediately comply with an EDR &#8212; and potentially having someone&#8217;s blood on their hands &#8212; or possibly leaking a customer record to the wrong person.</p>
<p>&#8220;We have a legal process to compel production of documents, and we have a streamlined legal process for police to get information from ISPs and other providers,&#8221; said <strong>Mark Rasch</strong>, a former prosecutor with the <strong>U.S. Department of Justice</strong>.</p>
<p>&#8220;And then we have this emergency process, almost like you see on [the television series] Law &amp; Order, where they say they need certain information immediately,&#8221; Rasch continued. &#8220;Providers have a streamlined process where they publish the fax or contact information for police to get emergency access to data. But there&#8217;s no real mechanism defined by most Internet service providers or tech companies to test the validity of a search warrant or subpoena. And so as long as it looks right, they&#8217;ll comply.&#8221;</p>
<p>To make matters more complicated, there are tens of thousands of police jurisdictions around the world &#8212; including roughly <a href="https://en.wikipedia.org/wiki/Law_enforcement_in_the_United_States#:~:text=There%20are%2017%2C985%20U.S.%20police,and%20federal%20law%20enforcement%20agencies." target="_blank" rel="noopener">18,000 in the United States alone</a> &#8212; and all it takes for hackers to succeed is illicit access to a single police email account.</p>
<h2>THE LAPSUS$ CONNECTION</h2>
<p>The reality that teenagers are now impersonating law enforcement agencies to subpoena privileged data on their targets at whim is evident in the dramatic backstory behind <strong>LAPSUS$</strong>, the data extortion group that <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener">recently hacked into some of the world&#8217;s most valuable technology companies</a>, including <strong>Microsoft</strong>, <strong>Okta</strong>, <strong>NVIDIA</strong> and <strong>Vodafone</strong>.</p>
<p>In <a href="https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/" target="_blank" rel="noopener">a blog post</a> about their recent hack, Microsoft said LAPSUS$ succeeded against its targets through a combination of low-tech attacks, mostly involving old-fashioned social engineering &#8212; such as bribing employees at or contractors for the target organization.</p>
<p>&#8220;Other tactics include phone-based social engineering; <a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">SIM-swapping</a> to facilitate account takeover; accessing personal email accounts of employees at target organizations; paying employees, suppliers, or business partners of target organizations for access to credentials and multi-factor authentication (MFA) approval; and intruding in the ongoing crisis-communication calls of their targets,&#8221; Microsoft wrote of LAPSUS$.</p>
<div id="attachment_59127" style="width: 874px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59127" loading="lazy" class="size-full wp-image-59127" src="media/bb2ea96b.infinityrecursion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion.png" alt="" width="864" height="718" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion-782x650.png 782w" sizes="(max-width: 864px) 100vw, 864px" /><p id="caption-attachment-59127" class="wp-caption-text">The roster of the now-defunct &#8220;Infinity Recursion&#8221; hacking team, from which some members of LAPSUS$ allegedly hail.</p></div>
<p>Researchers from security firms <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a> and <a href="https://www.paloaltonetworks.com" target="_blank" rel="noopener">Palo Alto Networks</a> say that prior to launching LAPSUS$, the group&#8217;s leader &#8220;White&#8221; (a.k.a. &#8220;WhiteDoxbin,&#8221; &#8220;Oklaqq&#8221;) was a founding member of a cybercriminal group calling itself the “<a href="https://web.archive.org/web/20210410013319/http://recursion.team/" target="_blank" rel="noopener">Recursion Team.</a>” This group specialized in SIM swapping targets of interest and participating in <a href="https://krebsonsecurity.com/?s=swatting" target="_blank" rel="noopener">“swatting” attacks</a>, wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address.</p>
<p>The founder of the Recursion Team was a then 14-year-old from the United Kingdom who used the handle &#8220;<strong>Everlynn</strong>.&#8221; On April 5, 2021, Everlynn posted a new sales thread to the cybercrime forum cracked[.]to titled, &#8220;Warrant/subpoena service (get law enforcement data from any service).&#8221; The price: $100 to $250 per request.</p>
<div id="attachment_59126" style="width: 715px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59126" loading="lazy" class="size-full wp-image-59126" src="media/829faddc.infinity-warrant.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinity-warrant.png" alt="" width="705" height="713" /><p id="caption-attachment-59126" class="wp-caption-text">Everlynn advertising a warrant/subpoena service based on fake EDRs. Image: Ke-la.com.</p></div>
<p>&#8220;Services [include] Apple, Snapchat, Google (more expensive), not doing Discord, basically any site mostly,&#8221; read Everlynn&#8217;s ad, which was posted by the user account &#8220;InfinityRecursion.&#8221;</p>
<p>A month prior on Cracked, Everlynn posted a sales thread, &#8220;1x Government Email Account || BECOME A FED!,&#8221; which advertised the ability to send email from a federal agency within the government of Argentina.</p>
<p>&#8220;I would like to sell a government email that can be used for subpoena for many companies such as Apple, Uber, Instagram, etc.,&#8221; Everlynn&#8217;s sales thread explained, setting the price at $150. &#8220;You can breach users and get private images from people on SnapChat like nudes, go hack your girlfriend or something haha. You won&#8217;t get the login for the account, but you&#8217;ll basically obtain everything in the account if you play your cards right. I am not legally responsible if you mishandle this. This is very illegal and you will get raided if you don&#8217;t use a vpn. You can also breach into the government systems for this, and find LOTS of more private data and sell it for way, way more.&#8221;</p>
<p>Last week, the <strong>BBC</strong> reported that authorities in the United Kingdom <a href="https://www.bbc.com/news/technology-60864283" target="_blank" rel="noopener">had detained seven individuals aged 16 to 21</a> in connection with LAPSUS$.<span id="more-59088"></span></p>
<h2>TAKING ON THE DOXBIN</h2>
<p>It remains unclear whether White or Everlynn were among those detained; U.K. police declined to name the suspects. But White&#8217;s real-life identity became public recently after he crossed the wrong people.</p>
<p>The de-anonymization of the LAPSUS$ leader began late last year after he purchased a website called <strong>Doxbin</strong>, a long-running and highly toxic online community that is used to &#8220;dox&#8221; or post deeply personal information on people.</p>
<p>Based on the feedback posted by Doxbin members, White was not a particularly attentive administrator. Longtime members soon took to harassing him about various components of the site falling into disrepair. That pestering eventually prompted White to sell Doxbin back to its previous owner at a considerable loss. But before doing so, White leaked the Doxbin user database.</p>
<p>White&#8217;s leak triggered a swift counterpunch from Doxbin&#8217;s staff, which naturally responded by posting on White perhaps the most thorough dox the forum had ever produced.</p>
<p>KrebsOnSecurity recently interviewed the past and current owner of the Doxbin &#8212; an established hacker who goes by the handle &#8220;<strong>KT</strong>.&#8221; According to KT, it is becoming more common for hackers to use EDRs for stalking, hacking, harassing and publicly humiliating others.</p>
<p>KT shared several recent examples of fraudulent EDRs obtained by hackers who bragged about their success with the method.</p>
<p>&#8220;Terroristic threats with a valid reason to believe somebody&#8217;s life is in danger is usually the go-to,&#8221; KT said, referring to the most common attestation that accompanies a fake EDR.</p>
<p>One of the phony EDRs shared by KT targeted an 18-year-old from Indiana, and was sent to the social media platform <strong>Discord</strong> earlier this year. The document requested the Internet address history of Discord accounts tied to a specific phone number used by the target. Discord complied with the request.</p>
<p>&#8220;Discord replies to EDRs in 30 minutes to one hour with the provided information,&#8221; KT claimed.</p>
<p>Asked about the validity of the unauthorized EDR shared by KT, Discord said the request came from a legitimate law enforcement account that was later determined to have been compromised.</p>
<p>“We can confirm that Discord received requests from a legitimate law enforcement domain and complied with the requests in accordance with our policies,&#8221; Discord said in a written statement. &#8220;We verify these requests by checking that they come from a genuine source, and did so in this instance. While our verification process confirmed that the law enforcement account itself was legitimate, we later learned that it had been compromised by a malicious actor. We have since conducted an investigation into this illegal activity and notified law enforcement about the compromised email account.&#8221;</p>
<p>KT said fake EDRs don&#8217;t have to come from police departments based in the United States, and that some people in the community of those sending fake EDRs are hacking into police department emails by first compromising the agency&#8217;s website. From there, they can drop a backdoor &#8220;shell&#8221; on the server to secure permanent access, and then create new email accounts within the hacked organization.</p>
<p>In other cases, KT said, hackers will try to guess the passwords of police department email systems. In these attacks, the hackers will identify email addresses associated with law enforcement personnel, and then attempt to authenticate using passwords those individuals have used at other websites that have been breached previously.</p>
<p>&#8220;A lot of governments overseas are using WordPress, and I know a kid on Telegram who has multiple shells on gov sites,&#8221; KT said. &#8220;It&#8217;s near impossible to get U.S. dot-govs nowadays, although I&#8217;ve seen a few people with it. Most govs use [Microsoft] Outlook, so it&#8217;s more difficult because theres usually some sort of multi-factor authentication. But not all have it.&#8221;</p>
<p>According to KT, Everlynn and White recently had a falling out, with White paying KT to publish a dox on Everlynn and to keep it pinned to the site&#8217;s home page. That dox states that Everlynn is a 15-year-old from the United Kingdom who has used a variety of monikers over the past year alone, including &#8220;<strong>Miku</strong>&#8221; and &#8220;<strong>Anitsu</strong>.&#8221;</p>
<p>KT said Everlynn&#8217;s dox is accurate, and that the youth has been arrested multiple times for issuing fake EDRs. But KT said each time Everlynn gets released from police custody, he goes right back to committing the same cybercrimes.</p>
<p>&#8220;Anitsu (Miku, Everlynn), an old staff member of Doxbin, was arrested probably 4-5 months ago for jacking government emails used for EDR&#8217;ing,&#8221; KT said. &#8220;White and him are not friends anymore though. White paid me a few weeks ago to pin his dox on Doxbin. Also, White had planned to use EDRs against me, due to a bet we had planned; dox for dox, winner gets 1 coin.&#8221;</p>
<h2>A FUNDAMENTALLY UNFIXABLE PROBLEM?</h2>
<p><strong>Nicholas Weaver</strong>, a security specialist and lecturer at the <strong>University of California, Berkeley</strong>, said one big challenge to combating fraudulent EDRs is that there is fundamentally no notion of global online identity.</p>
<p>&#8220;The only way to clean it up would be to have the FBI act as the sole identity provider for all state and local law enforcement,&#8221; Weaver said. &#8220;But even that won&#8217;t necessarily work because how does the FBI vet in real time that some request is really from some podunk police department?&#8221;</p>
<p>It&#8217;s not clear that the FBI would be willing or able to take on such a task. In November 2021, KrebsOnSecurity broke the news that hackers sent a fake email alert to thousands of state and local law enforcement entities through the FBI&#8217;s <strong>Law Enforcement Enterprise Portal</strong> (LEEP). In that attack, the intruders abused a <a href="https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/" target="_blank" rel="noopener">fairly basic and dangerous coding error on the website</a>, and the fake emails all came from a real <strong>fbi.gov</strong> address.</p>
<div id="attachment_57554" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57554" loading="lazy" class=" wp-image-57554" src="media/41fdae0e.fakefbiemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail.png" alt="" width="753" height="187" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail.png 1132w, https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail-768x191.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail-782x194.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-57554" class="wp-caption-text">The phony message sent in November 2021 via the FBI&#8217;s email system. </p></div>
<p>The particulars of how the FBI&#8217;s LEEP portal got hacked were provided by <strong>Pompompurin</strong>, the handle chosen by an individual who&#8217;s been involved in countless data breaches at major companies. But Doxbin&#8217;s KT told KrebsOnSecurity this week that White was the one who initially discovered the LEEP portal security weakness.</p>
<p>&#8220;White originally found that,&#8221; KT said. &#8220;Pom just took credit.&#8221;</p>
<p>KrebsOnSecurity asked the FBI whether it had any indication that its own systems were used for unauthorized EDRs. The FBI declined to answer that question, but confirmed it was aware of different schemes involving phony EDRs targeting both the public and the agency&#8217;s private sector partners.</p>
<p>&#8220;We take these reports seriously and vigorously pursue them,&#8221; reads a written statement shared by the FBI. &#8220;Visit <a href="https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Fwww.ic3.gov%2FMedia%2FY2022%2FPSA220307&amp;data=04%7C01%7Cmbasu%40fbi.gov%7C160439088ecf409eb67f08da10fdc44a%7C022914a9b95f4b7bbace551ce1a04071%7C0%7C0%7C637840979340972415%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=hcgwT27VEpaErDhWBKs7S%2FPzn5ZtdbyCIGgVOmrIr8w%3D&amp;reserved=0" target="_blank" rel="noopener">this page</a> for tips and resources to verify the information you are receiving. If you believe you are a victim of an emergency data request scheme, please report to <a href="https://usg02.safelinks.protection.office365.us/?url=http%3A%2F%2Fwww.ic3.gov%2F&amp;data=04%7C01%7Cmbasu%40fbi.gov%7C160439088ecf409eb67f08da10fdc44a%7C022914a9b95f4b7bbace551ce1a04071%7C0%7C0%7C637840979340972415%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=S8VwfF%2FGDZjThtKn60DKJ8Lve6IBID6XzkaVoq2USXY%3D&amp;reserved=0" target="_blank" rel="noopener">www.ic3.gov</a> or contact your local FBI field office.&#8221;</p>
<p>Rasch said while service providers need more rigorous vetting mechanisms for all types of legal requests, getting better at spotting unauthorized EDRs would require these companies to somehow know and validate the names of every police officer in the United States.</p>
<p>&#8220;One of the problems you have is there&#8217;s no validated master list of people who are authorized to make that demand,&#8221; Rasch said. &#8220;And that list is going to change all the time. But even then, the entire system is only as secure as the least secure individual police officer email account.&#8221;</p>
<p>The idea of impersonating law enforcement officers to obtain information typically only available via search warrant or subpoena is hardly new. A fictionalized example appeared in the second season of the hit television show <strong>Mr. Robot</strong>, wherein the main character Elliot <a href="https://www.theverge.com/2016/9/7/12835320/mr-robot-hack-report-s2e9-hidden-process" target="_blank" rel="noopener">pretends to be a police officer to obtain location data in real time from a cellular phone company</a>.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/AdHE5Nss4HI" width="760" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Weaver said what probably keeps fraudulent EDRs from being more common is that most people in the criminal hacking community perceive it as too risky. This is supported by the responses in discussion threads across multiple hacking forums where members sought out someone to perform an EDR on their behalf.</p>
<p>&#8220;It&#8217;s highly risky if you get caught,&#8221; Weaver said. &#8220;But doing this is not a matter of skill. It&#8217;s one of will. It&#8217;s a fundamentally unfixable problem without completely redoing how we think about identity on the Internet on a national scale.&#8221;</p>
<p>The current situation with fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for highly sensitive subscriber data. In July 2021, a bipartisan group of U.S. senators introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology.</p>
<p>&#8220;Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,&#8221; the lawmakers said in a statement introducing their bill.</p>
<p>The <a href="https://www.wyden.senate.gov/news/press-releases/wyden-tillis-and-whitehouse-introduce-bipartisan-bill-to-combat-counterfeit-court-orders" target="_blank" rel="noopener">Digital Authenticity for Court Orders Act</a> would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content.</p>


feed_id: https://krebsonsecurity.com/?p=59209
title: Fake Emergency Search Warrants Draw Scrutiny from Capitol Hill
uri: Fake-Emergency-Search-Warrants-Draw-Scrutiny-from-Capitol-Hill
url: https://krebsonsecurity.com/2022/03/fake-emergency-search-warrants-draw-scrutiny-from-capitol-hill/
content:
<p>On Tuesday, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">warned</a> that hackers increasingly are using compromised government and police department email accounts to obtain sensitive customer data from mobile providers, ISPs and social media companies. Today, one of the U.S. Senate&#8217;s most tech-savvy lawmakers said he was troubled by the report and is now asking technology companies and federal agencies for information about the frequency of such schemes.</p>
<p><img class="aligncenter wp-image-59128" src="media/b7372c46.legalrequest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png" alt="" width="759" height="631" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-782x650.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></p>
<p>At issue are forged &#8220;emergency data requests,&#8221; (EDRs) sent through hacked police or government agency email accounts. Tech companies usually require a search warrant or subpoena before providing customer or user data, but any police jurisdiction can use an EDR to request immediate access to data without a warrant, provided the law enforcement entity attests that the request is related to an urgent matter of life and death.</p>
<p>As Tuesday&#8217;s story showed, hackers have figured out there is no quick and easy way for a company that receives one of these EDRs to know whether it is legitimate. After all, there are roughly 18,000 distinct police organizations in the United States alone, and many thousands of government and police agencies worldwide.</p>
<p>Criminal hackers exploiting that ambiguity are enjoying remarkable success rates gaining access to the data they&#8217;re after, and some are now selling EDRs as a service to other crooks online.</p>
<p>This week&#8217;s piece included confirmation from social media platform <strong>Discord</strong> about a fraudulent EDR they recently processed. On Wednesday, <em>Bloomberg</em> <a href="https://www.bloomberg.com/news/articles/2022-03-30/apple-meta-gave-user-data-to-hackers-who-forged-legal-requests" target="_blank" rel="noopener">published a story</a> confirming that both <strong>Apple</strong> and <strong>Meta/Facebook</strong> have recently complied with fake EDRs.</p>
<p>Today, KrebsOnSecurity heard from <strong>Sen. Ron Wyden</strong> (D-Ore.), who said he was moved to action after reading this week&#8217;s coverage.</p>
<p>&#8220;Recent news reports have revealed an enormous threat to Americans&#8217; safety and national security,&#8221; Wyden said in a statement provided to KrebsOnSecurity. &#8220;I&#8217;m particularly troubled by the prospect that forged emergency orders may be coming from compromised foreign law enforcement agencies, and then used to target vulnerable individuals.&#8221;</p>
<p>&#8220;I&#8217;m requesting information from tech companies and multiple federal agencies to learn more about how emergency data requests are being abused by hackers,&#8221; Wyden&#8217;s statement continues. &#8220;No one wants tech companies to refuse legitimate emergency requests when someone&#8217;s safety is at stake, but the current system has clear weaknesses that need to be addressed. Fraudulent government requests are a significant concern, which is why I&#8217;ve already authored legislation to stamp out forged warrants and subpoenas.&#8221;<span id="more-59209"></span></p>
<p><a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">Tuesday&#8217;s story</a> showed how fraudulently obtained EDRs were a tool used by members of <strong>LAPSUS$</strong>, the data extortion group that recently hacked <strong>Microsoft</strong>, <strong>NVIDIA</strong>, <strong>Okta</strong> and <strong>Samsung</strong>. And it tracked the activities of a teenage hacker from the United Kingdom who was reportedly arrested multiple times for sending fake EDRs.</p>
<p>That was in March 2021, but there are similar fake EDR services on offer today. One example can be found on Telegram, wherein a member who favors the handle &#8220;<strong>Bug</strong>&#8221; has for the past month been selling access to various police and government email accounts.</p>
<p>All of the access Bug is currently offering was allegedly stolen from non-U.S. police and government email accounts, including a police department in India; a government ministry of the United Arab Emirates; the Brazilian Secretariat of Education; and Saudi Arabia&#8217;s Ministry of Education.</p>
<p>On Mar. 30, Bug posted a sales thread to the cybercrime forum <strong>Breached[.]co</strong> saying he could be hired to perform fake EDRs on targets at will, provided the account was recently active.</p>
<p>&#8220;I am doing LE Emergency Data Requests for snapchat, twitter, ig [Instagram] and many others,&#8221; Bug wrote. &#8220;Information we can get: emails, IPs, phone numbers, photos. Account must be active in the last week else we get rejected as shown below. Have gotten information only on Snapchat, Twitter and IG so far.&#8221;</p>
<div id="attachment_59211" style="width: 936px" class="wp-caption aligncenter"><a href="media/17f203f1.bug-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/bug-ad.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59211" loading="lazy" class="wp-image-59211 size-full" src="media/17f203f1.bug-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/bug-ad.png" alt="" width="926" height="564" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/bug-ad.png 926w, https://krebsonsecurity.com/wp-content/uploads/2022/03/bug-ad-768x468.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/bug-ad-782x476.png 782w" sizes="(max-width: 926px) 100vw, 926px" /></a><p id="caption-attachment-59211" class="wp-caption-text">An individual using the nickname &#8220;Bug&#8221; has been selling access to government and police email accounts for more than a month. Bug posted this sales thread on Wednesday.</p></div>
<p>KrebsOnSecurity sought comment from Instagram, Snapchat, and Twitter. This post will be updated in the event they respond.</p>
<p>The current scourge of fraudulent EDRs illustrates the dangers of relying solely on email to process legal requests for privileged subscriber data. In July 2021, Sen. Wyden and others introduced new legislation to combat the growing use of counterfeit court orders by scammers and criminals. The bill calls for funding for state and tribal courts to adopt widely available digital signature technology that meets standards developed by the National Institute of Standards and Technology.</p>
<p>“Forged court orders, usually involving copy-and-pasted signatures of judges, have been used to authorize illegal wiretaps and fraudulently take down legitimate reviews and websites by those seeking to conceal negative information and past crimes,” the lawmakers said in a statement introducing their bill.</p>
<p>The <a href="https://www.wyden.senate.gov/news/press-releases/wyden-tillis-and-whitehouse-introduce-bipartisan-bill-to-combat-counterfeit-court-orders" target="_blank" rel="noopener">Digital Authenticity for Court Orders Act</a> would require federal, state and tribal courts to use a digital signature for orders authorizing surveillance, domain seizures and removal of online content.</p>


feed_id: https://krebsonsecurity.com/?p=59085
title: The Original APT: Advanced Persistent Teenagers
uri: The-Original-APT-Advanced-Persistent-Teenagers
url: https://krebsonsecurity.com/2022/04/the-original-apt-advanced-persistent-teenagers/
content:
<p>Many organizations are already struggling to combat cybersecurity threats from ransomware purveyors and state-sponsored hacking groups, both of which tend to take days or weeks to pivot from an opportunistic malware infection to a full blown data breach. But few organizations have a playbook for responding to the kinds of virtual &#8220;smash and grab&#8221; attacks we&#8217;ve seen recently from <strong>LAPSUS$,</strong> a juvenile data extortion group whose short-lived, low-tech and remarkably effective tactics have put some of the world&#8217;s biggest corporations on edge.</p>
<p><img class="aligncenter size-full wp-image-59260" src="media/da398e09.apt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/apt.png" alt="" width="753" height="501" /></p>
<p>Since surfacing in late 2021, LAPSUS$ has <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener">gained access to the networks or contractors</a> for some of the world&#8217;s largest technology companies, including <strong>Microsoft</strong>, <strong>NVIDIA</strong>, <strong>Okta</strong> and <strong>Samsung</strong>. LAPSUS$ typically threatens to release sensitive data unless paid a ransom, but with most victims the hackers ended up publishing any information they stole (mainly computer source code).</p>
<p>Microsoft <a href="https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/" target="_blank" rel="noopener">blogged about its attack</a> at the hands of LAPSUS$, and about the group targeting its customers. It found LAPSUS$ used a variety of old-fashioned techniques that seldom show up in any corporate breach post-mortems, such as:</p>
<p>-targeting employees at their personal email addresses and phone numbers;<br />
-offering to pay $20,000 a week to employees who give up remote access credentials;<br />
-social engineering help desk and customer support employees at targeted companies;<br />
-bribing/tricking employees at mobile phone stores to hijack a target&#8217;s phone number;<br />
-intruding on their victims&#8217; crisis communications calls post-breach.</p>
<p>If these tactics sound like something you might sooner expect from spooky, state-sponsored &#8220;Advanced Persistent Threat&#8221; or <a href="https://www.mandiant.com/resources/apt-groups" target="_blank" rel="noopener"><strong>APT</strong> groups</a>, consider that the core LAPSUS$ members are thought to range in age from 15 to 21. Also, LAPSUS$ operates on a shoestring budget and is <a href="https://twitter.com/BillDemirkapi/status/1508527487655067660" target="_blank" rel="noopener">anything but stealthy</a>: According to Microsoft, LAPSUS$ doesn&#8217;t seem to cover its tracks or hide its activity. In fact, the group often announces its hacks on social media.</p>
<h2>ADVANCED PERSISTENT TEENAGERS</h2>
<p><img loading="lazy" class="aligncenter size-full wp-image-59264" src="media/35d99f90.persistence.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/persistence.png" alt="" width="753" height="429" /></p>
<p>This unusual combination makes LAPSUS$ something of an aberration that is probably more aptly referred to as &#8220;<strong>Advanced Persistent Teenagers</strong>,&#8221; said one CXO at a large organization that recently had a run-in with LAPSUS$.</p>
<p>&#8220;There is a lot of speculation about how good they are, tactics et cetera, but I think it’s more than that,&#8221; said the CXO, who spoke about the incident on condition of anonymity. &#8220;They put together an approach that industry thought suboptimal and unlikely. So it’s their golden hour.&#8221;</p>
<p>LAPSUS$ seems to have conjured some worst-case scenarios in the minds of many security experts, who worry what will happen when more organized cybercriminal groups start adopting these techniques.</p>
<p>&#8220;LAPSUS$ has shown that with only $25,000, a group of teenagers could get into organizations with mature cybersecurity practices,&#8221; said <strong>Amit Yoran</strong>, CEO of security firm <a href="https://www.tenable.com" target="_blank" rel="noopener">Tenable</a> and a former federal cybersecurity czar, testifying last week before the <strong>House Homeland Security Committee</strong>. &#8220;With much deeper pockets, focus, and mission, targeting critical infrastructure. That should be a sobering, if not terrifying, call to action.&#8221;</p>
<p>My CXO source said LAPSUS$ succeeds because they simply refuse to give up, and just keep trying until someone lets them in.</p>
<p>&#8220;They would just keep jamming a few individuals to get [remote] access, read some onboarding documents, enroll a new 2FA [two-factor authentication method] and exfiltrate code or secrets, like a smash-and-grab,&#8221; the CXO said. &#8220;These guys were not <a href="https://www.networkworld.com/article/2333149/are-you-l33t-.html#:~:text=The%20word%20%22l33t%22%20itself%20(,(also%20%22llama%22)." target="_blank" rel="noopener">leet</a>, just damn persistent.&#8221;<span id="more-59085"></span></p>
<h2>HOW DID WE GET HERE?</h2>
<p>The smash-and-grab attacks by LAPSUS$ obscure some of the group&#8217;s less public activities, which according to Microsoft include targeting individual user accounts at cryptocurrency exchanges to drain crypto holdings.</p>
<p>In some ways, the attacks from LAPSUS$ recall the <a href="https://krebsonsecurity.com/?s=%22twitter+hack%22" target="_blank" rel="noopener">July 2020 intrusion at Twitter</a>, wherein the accounts for Apple, Bill Gates, Jeff Bezos, Kanye West, Uber and others were made to tweet messages inviting the world to participate in a cryptocurrency scam that promised to double any amount sent to specific wallets. The flash scam netted the perpetrators more than $100,000 in the ensuing hours.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-59270" src="media/31390618.bezostweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/bezostweet.png" alt="" width="542" height="532" /></p>
<p>The group of teenagers who hacked Twitter hailed from a community that traded in hacked social media accounts. This community places a special premium on accounts with short &#8220;OG&#8221; usernames, and some of its most successful and notorious members were known to use all of the methods Microsoft attributed to LAPSUS$ in the service of hijacking prized OG accounts.</p>
<p>The Twitter hackers largely pulled it off by brute force, writes <em>Wired</em> on the July 15, 2020 hack.</p>
<p>&#8220;Someone was trying to phish employee credentials, and they were good at it,&#8221; Wired <a href="https://www.wired.com/story/inside-twitter-hack-election-plan/" target="_blank" rel="noopener">reported</a>. &#8220;They were calling up consumer service and tech support personnel, instructing them to reset their passwords. Many employees passed the messages onto the security team and went back to business. But a few gullible ones—maybe four, maybe six, maybe eight—were more accommodating. They went to a dummy site controlled by the hackers and entered their credentials in a way that served up their usernames and passwords as well as multifactor authentication codes.&#8221;</p>
<p>Twitter <a href="https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html" target="_blank" rel="noopener">revealed</a> that a key tactic of the group was &#8220;phone spear phishing&#8221; (a.k.a. &#8220;voice phishing&#8221; a.k.a. &#8220;vishing&#8221;). This involved calling up Twitter staffers using false identities, and tricking them into giving up credentials for an internal company tool that let the hackers reset passwords and multi-factor authentication setups for targeted users.</p>
<p>In August 2020, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener">warned that crooks were using voice phishing</a> to target new hires at major companies, impersonating IT employees and asking them to update their VPN client or log in at a phishing website that mimicked their employer&#8217;s VPN login page.</p>
<p>Two days after that story ran, the <strong>FBI</strong> and the <strong>Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA) <a href="https://krebsonsecurity.com/2020/08/fbi-cisa-echo-warnings-on-vishing-threat/" target="_blank" rel="noopener">issued their own warning on vishing</a>, saying the attackers typically compiled dossiers on employees at specific companies by mass-scraping public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research. The joint FBI/CISA alert continued:</p>
<blockquote><p>&#8220;Actors first began using unattributed Voice over Internet Protocol (VoIP) numbers to call targeted employees on their personal cellphones, and later began incorporating spoofed numbers of other offices and employees in the victim company. The actors used social engineering techniques and, in some cases, posed as members of the victim company’s IT help desk, using their knowledge of the employee’s personally identifiable information—including name, position, duration at company, and home address—to gain the trust of the targeted employee.&#8221;</p>
<p>&#8220;The actors then convinced the targeted employee that a new VPN link would be sent and required their login, including any 2FA [2-factor authentication] or OTP [one-time passwords]. The actor logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.&#8221;</p></blockquote>
<p>Like LAPSUS$, these vishers just kept up their social engineering attacks until they succeeded. As KrebsOnSecurity wrote about the vishers back in 2020:</p>
<blockquote><p>&#8220;It matters little to the attackers if the first few social engineering attempts fail. Most targeted employees are working from home or can be reached on a mobile device. If at first the attackers don’t succeed, they simply try again with a different employee.&#8221;</p>
<p>&#8220;And with each passing attempt, the phishers can glean important details from employees about the target’s operations, such as company-specific lingo used to describe its various online assets, or its corporate hierarchy.&#8221;</p>
<p>&#8220;Thus, each unsuccessful attempt actually teaches the fraudsters how to refine their social engineering approach with the next mark within the targeted organization.&#8221;</p></blockquote>
<h2>SMASH &amp; GRAB</h2>
<p>The primary danger with smash-and-grab groups like LAPSUS$ is not just their persistence but their ability to extract the maximum amount of sensitive information from their victims using compromised user accounts that typically have a short lifespan. After all, in many attacks, the stolen credentials are useful only so long as the impersonated employee isn&#8217;t also trying to use them.</p>
<p>This dynamic puts tremendous pressure on cyber incident response teams, which suddenly are faced with insiders who are trying frantically to steal everything of perceived value within a short window of time. On top of that, LAPSUS$ has a habit of posting screenshots on social media touting its access to internal corporate tools. These images and claims quickly go viral and create a public relations nightmare for the victim organization.</p>
<p>Single sign-on provider <strong>Okta</strong> experienced this firsthand last month, when LAPSUS$ posted screenshots that appeared to show Okta&#8217;s Slack channels and another with a Cloudflare interface. Cloudflare <a href="https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/" target="_blank" rel="noopener">responded</a> by resetting its employees&#8217; Okta credentials.</p>
<p>Okta quickly <a href="https://threatpost.com/lapsus-data-kidnappers-claim-snatches-from-microsoft-okta/179041/" target="_blank" rel="noopener">came under fire</a> for posting only a brief statement that said the screenshots LAPSUS$ shared were connected to a January 2022 incident involving the compromise of &#8220;a third-party customer support engineer working for one of our subprocessors,&#8221; and that &#8220;the matter was investigated and contained by the subprocessor.&#8221;</p>
<p>This assurance apparently did not sit well with many Okta customers, especially after LAPSUS$ began <a href="https://twitter.com/BillDemirkapi/status/1506339927935569928" target="_blank" rel="noopener">posting statements that disputed some of Okta&#8217;s claims</a>. On March 25, Okta <a href="https://venturebeat.com/2022/03/25/okta-on-handling-of-lapsus-breach-we-made-a-mistake/#:~:text=Okta%20has%20released%20an%20apology,impacted%20hundreds%20of%20its%20customers." target="_blank" rel="noopener">issued an apology</a> for its handling of the January breach at a third-party support provider, which ultimately affected hundreds of its customers.</p>
<p>My CXO source said the lesson from LAPSUS$ is that even short-lived intrusions can have a long-term negative impact on victim organizations &#8212; especially when victims are not immediately forthcoming about the details of a security incident that affects customers.</p>
<p>&#8220;It does force us to think about insider access differently,&#8221; the CXO told KrebsOnSecurity. &#8220;Nation states have typically wanted longer, more strategic access; ransomware groups want large lateral movement. LAPSUS$ doesn&#8217;t care, it’s more about, &#8216;What can these 2-3 accounts get me in the next 6 hours?&#8217; We haven’t optimized to defend that.&#8221;</p>
<p>Any organizations wondering what they can do to harden their systems against attacks from groups like LAPSUS$ should consult <a href="https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/#Detections" target="_blank" rel="noopener">Microsoft&#8217;s recent blog post on the group&#8217;s activities, tactics and tools</a>. Microsoft&#8217;s guidance includes recommendations that can help prevent account takeovers or at least mitigate the impact from stolen employee credentials.</p>


feed_id: https://krebsonsecurity.com/?p=59305
title: Actions Target Russian Govt. Botnet, Hydra Dark Market
uri: Actions-Target-Russian-Govt-Botnet-Hydra-Dark-Market
url: https://krebsonsecurity.com/2022/04/actions-target-russian-govt-botnet-hydra-dark-market/
content:
<p>The <strong>U.S. Federal Bureau of Investigation</strong> (FBI) says it has disrupted a giant botnet built and operated by a Russian government intelligence unit known for launching destructive cyberattacks against energy infrastructure in the United States and Ukraine. Separately, law enforcement agencies in the U.S. and Germany moved to decapitate &#8220;<strong>Hydra</strong>,&#8221; a billion-dollar Russian darknet drug bazaar that also helped to launder the profits of multiple Russian ransomware groups.</p>
<p><img class="aligncenter size-full wp-image-59311" src="media/7ddb333b.botclops.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/botclops.png" alt="" width="505" height="446" /></p>
<p>FBI officials <a href="https://www.fbi.gov/news/pressrel/press-releases/director-christopher-wray-announces-actions-to-disrupt-and-prosecute-russian-criminal-activity-040622" target="_blank" rel="noopener">said</a> Wednesday they disrupted &#8220;<strong>Cyclops Blink</strong>,&#8221; a collection of compromised networking devices managed by hackers working with the Russian Federation&#8217;s <strong>Main Intelligence Directorate</strong> (GRU).</p>
<p>A <a href="https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation" target="_blank" rel="noopener">statement</a> from the <strong>U.S. Department of Justice</strong> (DOJ) says the GRU&#8217;s hackers built Cyclops Blink by exploiting previously undocumented security weaknesses in firewalls and routers made by both <strong>ASUS</strong> and <strong>WatchGuard Technologies</strong>. The DOJ said it did not seek to disinfect compromised devices; instead, it obtained court orders to remove the Cyclops Blink malware from its &#8220;command and control&#8221; servers &#8212; the hidden machines that allowed the attackers to orchestrate the activities of the botnet.</p>
<p>The FBI and other agencies <a href="https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter" target="_blank" rel="noopener">warned in March</a> that the Cyclops Blink malware was built to replace a threat called &#8220;<strong>VPNFilter</strong>,&#8221; an earlier malware platform that targeted <a href="https://krebsonsecurity.com/2018/05/fbi-kindly-reboot-your-router-now-please/" target="_blank" rel="noopener">vulnerabilities in a number of consumer-grade wireless and wired routers</a>. In May 2018, the FBI executed a similar strategy to dismantle VPNFilter, which had spread to more than a half-million consumer devices.</p>
<p>On April 1, ASUS <a href="https://www.asus.com/content/ASUS-Product-Security-Advisory/" target="_blank" rel="noopener">released updates</a> to fix the security vulnerability in a range of its Wi-Fi routers. Meanwhile, WatchGuard appears to have <a href="https://arstechnica.com/information-technology/2022/04/watchguard-failed-to-disclose-critical-flaw-exploited-by-russian-hackers/?utm_source=twitter&amp;utm_social-type=owned&amp;utm_brand=ars&amp;utm_medium=social" target="_blank" rel="noopener">silently fixed its vulnerability in an update shipped almost a year ago</a>, according to <strong>Dan Goodin</strong> at <em>Ars Technica.</em><span id="more-59305"></span></p>
<h2>SANDWORM AND TRITON</h2>
<p><img loading="lazy" class="aligncenter wp-image-36655" src="media/a96fd646.networktechnicians.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png" alt="" width="748" height="495" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png 1212w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-940x622.png 940w" sizes="(max-width: 748px) 100vw, 748px" /></p>
<p>Security experts say both VPNFilter and Cyclops Blink are the work of a hacking group known as <strong>Sandworm</strong> or <strong>Voodoo Bear</strong>, the same Russian team blamed for disrupting Ukraine&#8217;s electricity in 2015.</p>
<p>Sandworm also has been implicated in the &#8220;<a href="https://collaborate.mitre.org/attackics/index.php/Software/S0001" target="_blank" rel="noopener">Industroyer</a>&#8221; malware attacks on Ukraine&#8217;s power grid in December 2016, as well as the 2016 global malware contagion &#8220;<a href="https://en.wikipedia.org/wiki/Petya_and_NotPetya" target="_blank" rel="noopener">NotPetya,</a>&#8221; which crippled companies worldwide using an exploit believed to have been developed by and then stolen from the <strong>U.S. National Security Agency</strong> (NSA).</p>
<p>The action against Cyclops Blink came just weeks after the Justice Department <a href="https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical" target="_blank" rel="noopener">unsealed indictments against four Russian men</a> accused of launching cyberattacks on power utilities in the United States and abroad.</p>
<p>One of the indictments named three officers of Russia&#8217;s <strong>Federal Security Service</strong> (FSB) suspected of being members of <a href="https://en.wikipedia.org/wiki/Berserk_Bear" target="_blank" rel="noopener">Berserk Bear, a.k.a. Dragonfly 2.0, a.k.a. Havex</a>, which has been blamed for targeting electrical utilities and other critical infrastructure worldwide and is widely believed to be working at the behest of the Russian government.</p>
<p>The other indictment named Russians affiliated with a skilled hacking group known as <a href="https://arstechnica.com/tech-policy/2022/03/feds-allege-destructive-russian-hackers-targeted-us-oil-refineries/" target="_blank" rel="noopener">&#8220;Triton&#8221; or &#8220;Trisis,&#8221;</a> which infected a Saudi oil refinery with destructive malware in 2017, and then attempted to do the same to U.S. energy facilities.</p>
<p>The Justice Department said that in Dragonfly&#8217;s first stage between 2012 and 2014, the defendants hacked into computer networks of industrial control systems (ICS) companies and software providers, and then hid malware inside legitimate software updates for such systems.</p>
<p>&#8220;After unsuspecting customers downloaded Havex-infected updates, the conspirators would use the malware to, among other things, create backdoors into infected systems and scan victims’ networks for additional ICS/SCADA devices,&#8221; the DOJ said. &#8220;Through these and other efforts, including spearphishing and “watering hole” attacks, the conspirators installed malware on more than 17,000 unique devices in the United States and abroad, including ICS/SCADA controllers used by power and energy companies.&#8221;</p>
<p>In Dragonfly&#8217;s second iteration between 2014 and 2017, the hacking group spear-phished more than 3,300 people at more than 500 U.S. and international companies and entities, including U.S. federal agencies like the <strong>Nuclear Regulatory Commission</strong>.</p>
<p>&#8220;In some cases, the spearphishing attacks were successful, including in the compromise of the business network (i.e., involving computers not directly connected to ICS/SCADA equipment) of the <strong>Wolf Creek Nuclear Operating Corporation</strong> (Wolf Creek) in Burlington, Kansas, which operates a nuclear power plant,&#8221; the DOJ&#8217;s account continues. &#8220;Moreover, after establishing an illegal foothold in a particular network, the conspirators typically used that foothold to penetrate further into the network by obtaining access to other computers and networks at the victim entity.&#8221;</p>
<h2>HYDRA</h2>
<div id="attachment_59309" style="width: 682px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59309" loading="lazy" class="size-full wp-image-59309" src="media/978d526e.federationtower.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/federationtower.png" alt="" width="672" height="446" /><p id="caption-attachment-59309" class="wp-caption-text">Federation Tower, Moscow. Image: Evgeniy Vasilev.</p></div>
<p>Also this week, German authorities seized the server infrastructure for the Hydra Market, a bustling underground market for illegal narcotics, stolen data and money laundering that&#8217;s been operating since 2015. The <strong>German Federal Criminal Police Office</strong> (BKA) <a href="https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2022/Presse2022/220405_PM_IllegalerDarknetMarktplatz.html" target="_blank" rel="noopener">said</a> Hydra had roughly 17 million customers, and over 19,000 vendors, with sales amounting to at least 1.23 billion euros in 2020 alone.</p>
<p>In <a href="https://home.treasury.gov/news/press-releases/jy0701" target="_blank" rel="noopener">a statement on the Hydra takedown</a>, the <strong>U.S. Department of Treasury</strong> said blockchain researchers had determined that approximately 86 percent of the illicit Bitcoin received directly by Russian virtual currency exchanges in 2019 came from Hydra.</p>
<p>Treasury sanctioned a number of cryptocurrency wallets associated with Hydra and with a virtual currency exchange called &#8220;<strong>Garantex</strong>,&#8221; which the agency says processed more than $100 million in transactions associated with illicit actors and darknet markets. That amount included roughly $8 million in ransomware proceeds laundered through Hydra on behalf of multiple ransomware groups, including <a href="https://en.wikipedia.org/wiki/Ryuk_(ransomware)" target="_blank" rel="noopener">Ryuk</a> and <a href="https://krebsonsecurity.com/tag/conti/" target="_blank" rel="noopener">Conti</a>.</p>
<p>&#8220;Today’s action against Hydra and Garantex builds upon recent sanctions against virtual currency exchanges SUEX and CHATEX, both of which, like Garantex, operated out of Federation Tower in Moscow, Russia,&#8221; the Treasury Department said.</p>


feed_id: https://krebsonsecurity.com/?p=59326
title: Double-Your-Crypto Scams Share Crypto Scam Host
uri: Double-Your-Crypto-Scams-Share-Crypto-Scam-Host
url: https://krebsonsecurity.com/2022/04/double-your-crypto-scams-share-crypto-scam-host/
content:
<p><img class="aligncenter wp-image-59331" src="media/f28497bb.cryptopeople.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/cryptopeople.png" alt="" width="766" height="501" /></p>
<p>Online scams that try to separate the unwary from their cryptocurrency are a dime a dozen, but a great many seemingly disparate crypto scam websites tend to rely on the same dodgy infrastructure providers to remain online in the face of massive fraud and abuse complaints from their erstwhile customers. Here&#8217;s a closer look at hundreds of phony crypto investment schemes that are all connected through a hosting provider which caters to people running crypto scams.</p>
<p>A security researcher recently shared with KrebsOnSecurity an email he received from someone who said they foolishly invested an entire bitcoin (currently worth ~USD $43,000) at a website called ark-x2[.]org, which promised to double any cryptocurrency investment made with the site.</p>
<p>The ark-x2[.]org site pretended to be a crypto giveaway website run by <a href="https://twitter.com/CathieDWood" target="_blank" rel="noopener">Cathie Wood</a>, the founder and CEO of <strong>ARKinvest</strong>, an established Florida company that manages several exchange-traded investment funds. This is hardly the first time scammers have impersonated Wood or ARKinvest; <a href="https://twitter.com/cathiedwood/status/1313547340272340993?lang=en" target="_blank" rel="noopener">a tweet from Wood in 2020 warned</a> that the company would never use YouTube, Twitter, Instagram or any social media to solicit money.</p>
<p>At the crux of these scams are well-orchestrated video productions published on YouTube and Facebook that claim to be a &#8220;live event&#8221; featuring famous billionaires. In reality, these videos just rehash older footage while peppering viewers with prompts to sign up at a scam investment site &#8212; one they claim has been endorsed by the celebrities.</p>
<p>&#8220;I was watching a live video at YouTube where Elon Musk, Cathy Wood, and Jack Dorsey were talking about Crypto,&#8221; the victim told my security researcher friend. &#8220;An overlay on the video pointed to subscribing to the event at their website. I&#8217;ve been following Cathy Wood in her analysis on financial markets, so I was in a comfortable and trusted environment. The three of them are bitcoin maximalists in a sense, so it made perfect sense they were organizing a giveaway.&#8221;</p>
<p>&#8220;Without any doubt (other than whether the transfer would go through), I sent them 1 BTC (~$42,800), and they were supposed to return 2 BTC back,&#8221; the victim continued. &#8220;In hindsight, this was an obvious scam. But the live video and the ARK Invest website is what produced the trusted environment to me. I realized a few minutes later, when the live video looped. It wasn&#8217;t actually live, but a replay of a video from 6 months ago.&#8221;</p>
<p>Ark-x2[.]org is no longer online. But a look at the Internet address historically tied to this domain (186.2.171.79) shows the same address is used to host or park <a href="https://docs.google.com/spreadsheets/d/1R3fZBzb75eQ3_RSxZ1Oq2DErZpkN-f5IMZj4i8IRs80/edit?usp=sharing" target="_blank" rel="noopener">hundreds of other newly-minted crypto scam domains</a>, including <strong>coinbase-x2[.]net </strong>(pictured below).</p>
<div id="attachment_59329" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59329" loading="lazy" class=" wp-image-59329" src="media/48d94cb0.coinbase-x2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/coinbase-x2.png" alt="" width="767" height="407" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/coinbase-x2.png 1401w, https://krebsonsecurity.com/wp-content/uploads/2022/04/coinbase-x2-768x407.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/coinbase-x2-782x415.png 782w" sizes="(max-width: 767px) 100vw, 767px" /><p id="caption-attachment-59329" class="wp-caption-text">The crypto scam site coinbase-x2[.]net, which snares unwary investors with promises of free money.</p></div>
<p>Typical of crypto scam sites, Coinbase-x2 promises a chance to win 50,000 ETH (Ethereum virtual currency), plus a &#8220;welcome bonus&#8221; wherein they promise to double any crypto investment made with the platform. But everyone who falls for this greed trap soon discovers they won&#8217;t be getting anything in return, and that their &#8220;investment&#8221; is gone forever.</p>
<p>There isn&#8217;t a lot of information about who bought these crypto scam domains, as most of them were registered in the past month at registrars that <a href="https://krebsonsecurity.com/2018/03/who-is-afraid-of-more-spams-and-scams/" target="_blank" rel="noopener">automatically redact the site&#8217;s WHOIS ownership records</a>.</p>
<p>However, <a href="https://krebsonsecurity.com/wp-content/uploads/2022/04/cryptohost-us.txt" target="_blank" rel="noopener">several dozen of the domains</a> are in the <a href="https://en.wikipedia.org/wiki/.us" target="_blank" rel="noopener">.us domain space</a>, which is technically supposed to be reserved for entities physically based in the United States. Those Dot-us domains all contain the registrant name <strong>Sergei Orlovets</strong> from Moscow, the email address <strong>ulaninkirill52@gmail.com</strong>, and the phone number <strong>+7.9914500893</strong>. Unfortunately, each of these clues lead to a dead end, meaning they were likely picked and used solely for these scam sites.</p>
<p>A dig into the Domain Name Server (DNS) records for Coinbase-x2[.]net shows it is hosted at a service called <strong>Cryptohost[.]to</strong>. Cryptohost also controls several other address ranges, including 194.31.98.X, which is currently home to even more crypto scam websites, many targeting lesser-known cryptocurrencies like <strong>Polkadot</strong>.</p>
<p><img loading="lazy" class="aligncenter wp-image-59394" src="media/6493756f.digcryptohostdotto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/digcryptohostdotto.png" alt="" width="751" height="399" /></p>
<p>An ad posted to the Russian-language hacking forum BHF last month touted Cryptohost as a &#8220;bulletproof hosting provider for all your projects,&#8221; i.e., it can be relied upon to ignore abuse complaints about its customers.</p>
<p>&#8220;Why choose us? We don&#8217;t keep your logs!,&#8221; someone claiming to represent Cryptohost wrote to denizens of BHF.</p>
<p>Cryptohost says its service is backstopped by <strong>DDoS-Guard</strong>, a Russian company that has featured here recently for providing services to the sanctioned terrorist group <a href="https://krebsonsecurity.com/2021/01/hamas-may-be-threat-to-8chan-qanon-online/" target="_blank" rel="noopener">Hamas</a> and to the conspiracy theory groups <a href="https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/" target="_blank" rel="noopener">QAnon/8chan</a>.</p>
<div id="attachment_59336" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59336" loading="lazy" class=" wp-image-59336" src="media/fc48c4aa.polkadotscam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/polkadotscam.png" alt="" width="761" height="432" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/polkadotscam.png 1435w, https://krebsonsecurity.com/wp-content/uploads/2022/04/polkadotscam-768x436.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/polkadotscam-782x444.png 782w" sizes="(max-width: 761px) 100vw, 761px" /><p id="caption-attachment-59336" class="wp-caption-text">A scam site at Cryptohost targeting Polkadot cryptocurrency holders.</p></div>
<p>Cryptohost did not respond to requests for comment.<span id="more-59326"></span></p>
<p>Signing up as a customer at Cryptohost presents a control panel that includes the IP address 188.127.235.21, which belongs to a hosting provider in Moscow called <strong>SmartApe</strong>. SmartApe says its main advantage is unlimited disk space, &#8220;which allows you to host an unlimited number of sites for little money.&#8221;</p>
<p>According to <strong>FinTelegram</strong>, a blog that bills itself as a crowdsourced financial intelligence service that covers investment scams, SmartApe is a &#8220;<a href="https://fintelegram.com/r4i-smartape-the-russian-israeli-hosting-company-for-cybercriminals/" target="_blank" rel="noopener">Russian-Israeli hosting company for cybercriminals</a>.&#8221;</p>
<p>SmartApe CEO <a href="https://www.linkedin.com/in/mark-tepterev-97a16a18/" target="_blank" rel="noopener">Mark Tepterev</a> declined to comment on the allegations from FinTelegram, but said the company has thousands of clients, some of whom have their own clients. </p>
<div id="attachment_59401" style="width: 602px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59401" loading="lazy" class="size-full wp-image-59401" src="media/c5fafd89.cryptohostpanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/cryptohostpanel.png" alt="" width="592" height="686" /><p id="caption-attachment-59401" class="wp-caption-text">Cryptohost&#8217;s customer panel, which points to an IP address at Russian hosting provider SmartApe.</p></div>
<p>&#8220;Also we host other hostings that have their own thousands of customers,&#8221; Tepterev said. &#8220;Of course, there are clients who use our services in their dubious interests. We immediately block such clients upon receipt of justified complaints.&#8221;</p>
<p>Much of the text used in these scam sites has been invoked verbatim in similar schemes dating back at least two years, and it&#8217;s likely that scam website templates are re-used so long as they continue to reel in new investors. Searching online for the phrase &#8220;During this unique event we will give you a chance to win&#8221; reveals many current and former sites tied to this scam.</p>
<p>While it may seem incredible that people will fall for stuff like this, such scams reliably generate decent profits. When <a href="https://krebsonsecurity.com/tag/twitter-hack/" rel="noopener" target="_blank">Twitter got hacked in July 2020</a> and some of the most-followed celebrity accounts on Twitter started tweeting double-your-crypto offers, 383 people sent more than $100,000 in a few hours.</p>
<p>In Sept. 2021, the <strong>Bitcoin Foundation</strong> (bitcoin.org) was hacked, with the intruders placing <a href="https://www.coindesk.com/tech/2021/09/23/bitcoinorg-appears-hacked-by-giveaway-scam/" target="_blank" rel="noopener">a pop-up message on the site asking visitors to send money</a>. The message said any sent funds would be doubled and returned, claiming that the Bitcoin Foundation had set up the program as a way of &#8220;giving back to the community.&#8221; The brief scam netted more than $17,000.</p>
<p>According to the <strong>U.S. Federal Trade Commission</strong>, nearly 7,000 people lost <a href="https://www.ftc.gov/news-events/news/press-releases/2021/05/ftc-data-shows-huge-spike-cryptocurrency-investment-scams" target="_blank" rel="noopener">more than $80 million in crypto scams</a> from October 2020 through March 2021 based on consumer fraud reports. That&#8217;s a significant jump from the year prior, when the FTC tracked just 570 cryptocurrency investment scam complaints totaling $7.5 million.</p>
<p>A recent report from blockchain analysis firm <a href="https://blog.chainalysis.com/reports/2022-crypto-crime-report-introduction/" target="_blank" rel="noopener">Chainalysis</a> found that scammers stole approximately $14 billion worth of cryptocurrency in 2021 &#8212; nearly twice the $7.8 billion stolen by scammers in 2020, the report found.</p>
<p>In March, Australia&#8217;s competition watchdog <a href="https://www.reuters.com/technology/australia-watchdog-sues-facebook-owner-meta-over-false-cryptocurrency-ads-2022-03-17/" rel="noopener" target="_blank">filed a lawsuit against Facebook owner Meta Platforms</a>, alleging the social media giant failed to prevent scammers using its platform to promote fake ads featuring well-known people. The complaint alleges the advertisements, which endorsed investment in cryptocurrency or money-making schemes, could have misled Facebook users into believing they were promoted by famous Australians.</p>
<p>In many ways, the crypto giveaway scam is a natural extension of perhaps the oldest cyber fraud in the book: Advanced-fee fraud. Most commonly associated with <a href="https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/nigerian-letter-or-419-fraud" target="_blank" rel="noopener">Nigerian Letter or &#8220;419&#8221; fraud</a> and lottery/sweepstakes schemes, advanced fee scams promise a financial windfall if only the intended recipient will step up and claim what is rightfully theirs &#8212; and oh by the way just pay this small administrative fee and we&#8217;ll send the money.</p>
<p>What makes these double-your-crypto sites successful is not just ignorance and avarice, but the idea held by many novice investors that cryptocurrencies are somehow magical money-minting machines, or perhaps virtual slot machines that will eventually pay off if one simply deposits enough coinage.</p>


feed_id: https://krebsonsecurity.com/?p=59419
title: RaidForums Gets Raided, Alleged Admin Arrested
uri: RaidForums-Gets-Raided-Alleged-Admin-Arrested
url: https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/
content:
<p>The <strong>U.S. Department of Justice</strong> (DOJ) said today it seized the website and user database for <strong>RaidForums</strong>, an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world&#8217;s largest data breaches since 2015. The DOJ also charged the alleged administrator of RaidForums &#8212; 21-year-old <strong>Diogo Santos Coelho</strong>, of Portugal &#8212; with six criminal counts, including conspiracy, access device fraud and aggravated identity theft.</p>
<p><img class="aligncenter wp-image-59420" src="media/75057107.raidforums-seized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/raidforums-seized.png" alt="" width="750" height="484" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/raidforums-seized.png 1197w, https://krebsonsecurity.com/wp-content/uploads/2022/04/raidforums-seized-768x495.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/raidforums-seized-782x504.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>The &#8220;raid&#8221; in RaidForums is a nod to the community&#8217;s humble beginnings in 2015, when it was primarily an online venue for organizing and supporting various forms of electronic harassment. According to the DOJ, that early activity included &#8216;<strong>raiding</strong>&#8216; &#8212; posting or sending an overwhelming volume of contact to a victim&#8217;s online communications medium &#8212; and &#8216;<a href="https://krebsonsecurity.com/tag/swatting/" target="_blank" rel="noopener">swatting</a>,&#8217; the practice of making false reports to public safety agencies of situations that would necessitate a significant, and immediate armed law enforcement response.&#8221;</p>
<p>But over the years as trading in hacked databases became big business, RaidForums emerged as the go-to place for English-speaking hackers to peddle their wares. Perhaps the most bustling marketplace within RaidForums was its &#8220;<strong>Leaks Market</strong>,&#8221; which described itself as a place to buy, sell, and trade hacked databases and leaks.</p>
<p>The government alleges Coelho and his forum administrator identity &#8220;<strong>Omnipotent</strong>&#8221; profited from the illicit activity on the platform by charging &#8220;escalating prices for membership tiers that offered greater access and features, including a top-tier &#8216;God&#8217; membership status.&#8221;</p>
<p>&#8220;RaidForums also sold &#8216;credits&#8217; that provided members access to privileged areas of the website and enabled members to &#8216;unlock&#8217; and download stolen financial information, means of identification, and data from compromised databases, among other items,&#8221; the DOJ said in <a href="https://www.justice.gov/usao-edva/pr/us-leads-seizure-one-world-s-largest-hacker-forums-and-arrests-administrator" target="_blank" rel="noopener">a written statement</a>. &#8220;Members could also earn credits through other means, such as by posting instructions on how to commit certain illegal acts.&#8221;</p>
<p>Prosecutors say Coelho also personally sold stolen data on the platform, and that Omnipotent directly facilitated illicit transactions by operating a fee-based “<strong>Official Middleman</strong>” service, a kind of escrow or insurance service that denizens of RaidForums were encouraged to use when transacting with other criminals.</p>
<p>Investigators described multiple instances wherein undercover federal agents or confidential informants used Omnipotent&#8217;s escrow service to purchase huge tranches of data from one of Coelho&#8217;s alternate user  identities &#8212; meaning Coelho not only sold data he&#8217;d personally hacked but also further profited by insisting the transactions were handled through his own middleman service.</p>
<p>Not all of those undercover buys went as planned. One incident described in <a href="https://www.justice.gov/usao-edva/press-release/file/1493601/download" target="_blank" rel="noopener">an affidavit by prosecutors</a> (PDF) appears related to the sale of tens of millions of consumer records stolen last year from <strong>T-Mobile</strong>, although the government refers to the victim only as a major telecommunications company and wireless network operator in the United States.</p>
<p>On Aug. 11, 2021, an individual using the moniker &#8220;<strong>SubVirt</strong>&#8221; posted on RaidForums an offer to sell Social Security numbers, dates of birth and other records on more than 120 million people in the United States (SubVirt would later edit the sales thread to say 30 million records). Just days later, <a href="https://krebsonsecurity.com/2021/08/t-mobile-breach-exposed-ssn-dob-of-40m-people/" target="_blank" rel="noopener">T-Mobile would acknowledge a data breach</a> affecting 40 million current, former or prospective customers who applied for credit with the company.</p>
<p>The government says the victim firm hired a third-party to purchase the database and prevent it from being sold to cybercriminals. That third-party ultimately paid approximately $200,000 worth of bitcoin to the seller, with the agreement that the data would be destroyed after sale. &#8220;However, it appears the co-conspirators continued to attempt to sell the databases after the third-party&#8217;s purchase,&#8221; the affidavit alleges.</p>
<p>The FBI&#8217;s seizure of RaidForums was <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener">first reported by KrebsOnSecurity on Mar. 23</a>, after a federal investigator confirmed rumors that the FBI had been secretly operating the RaidForums website for weeks.<span id="more-59419"></span></p>
<p>Coelho landed on the radar of U.S. authorities in June 2018, when he tried to enter the United States at the <strong>Hartsfield-Jackson International Airport</strong> in Atlanta. The government obtained a warrant to search the electronic devices Coelho had in his luggage and found text messages, files and emails showing he was the RaidForums administrator Omnipotent.</p>
<p>&#8220;In an attempt to retrieve his items, Coelho called the lead FBI case agent on or around August 2, 2018, and used the email address <strong>unrivalled@pm.me</strong> to email the agent,&#8221; the government&#8217;s affidavit states. Investigators found this same address was used to register <strong>rf.ws</strong> and <strong>raid.lol</strong>, which Omnipotent announced on the forum would serve as alternative domain names for RaidForums in case the site&#8217;s primary domain was seized.</p>
<p>The DOJ said Coelho was arrested in the United Kingdom on January 31, at the United States&#8217; request, and remains in custody pending the resolution of his extradition hearing. A <a href="https://www.nationalcrimeagency.gov.uk/news/hacking-forum-taken-offline-and-uk-suspect-arrested" target="_blank" rel="noopener">statement</a> from the <strong>U.K.&#8217;s National Crime Agency</strong> (NCA) said the RaidForum&#8217;s takedown was the result of &#8220;<strong>Operation Tourniquet</strong>,&#8221; which was carried out by the NCA in cooperation with the United Staes, <strong>Europol</strong> and four other countries, and resulted in &#8220;a number of linked arrests.&#8221;</p>
<p>A copy of the indictment against Coelho is available <a href="https://www.justice.gov/usao-edva/press-release/file/1493606/download" target="_blank" rel="noopener">here</a> (PDF).</p>


