# articles

feed_id: https://krebsonsecurity.com/?p=66726
title: Incognito Darknet Market Mass-Extorts Buyers, Sellers
uri: Incognito-Darknet-Market-Mass-Extorts-Buyers-Sellers
url: https://krebsonsecurity.com/2024/03/incognito-darknet-market-mass-extorts-buyers-sellers/
content:
<p>Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar <strong>Incognito Market</strong> has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000. The bold mass extortion attempt comes just days after Incognito Market administrators reportedly pulled an &#8220;exit scam&#8221; that left users unable to withdraw millions of dollars worth of funds from the platform.</p>
<div id="attachment_66727" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66727" decoding="async" class=" wp-image-66727" src="media/1bb51008.incognito-extortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion.png" alt="" width="751" height="197" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion.png 1370w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion-768x201.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion-782x205.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-66727" class="wp-caption-text">An extortion message currently on the Incognito Market homepage.</p></div>
<p>In the past 24 hours, the homepage for the Incognito Market was updated to include a blackmail message from its owners, saying they will soon release purchase records of vendors who refuse to pay to keep the records confidential.</p>
<p>&#8220;We got one final little nasty surprise for y&#8217;all,&#8221; reads the message to Incognito Market users. &#8220;We have accumulated a list of private messages, transaction info and order details over the years. You&#8217;ll be surprised at the number of people that relied on our &#8216;auto-encrypt&#8217; functionality. And by the way, your messages and transaction IDs were never actually deleted after the &#8216;expiry&#8217;&#8230;.SURPRISE SURPRISE!!! Anyway, if anything were to leak to law enforcement, I guess nobody never slipped up.&#8221;</p>
<p>Incognito Market says it plans to publish the entire dump of 557,000 orders and 862,000 cryptocurrency transaction IDs at the end of May.</p>
<p>&#8220;Whether or not you and your customers&#8217; info is on that list is totally up to you,&#8221; the Incognito administrators advised. &#8220;And yes, this is an extortion!!!!&#8221;</p>
<p>The extortion message includes a &#8220;Payment Status&#8221; page that lists the darknet market&#8217;s top vendors by their handles, saying at the top that &#8220;you can see which vendors care about their customers below.&#8221; The names in green supposedly correspond to users who have already opted to pay.</p>
<div id="attachment_66729" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66729" decoding="async" loading="lazy" class=" wp-image-66729" src="media/8f7c9d2e.incognito-status.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status.png" alt="" width="745" height="394" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status.png 1486w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status-768x406.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status-782x414.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status-267x140.png 267w" sizes="(max-width: 745px) 100vw, 745px" /><p id="caption-attachment-66729" class="wp-caption-text">The &#8220;Payment Status&#8221; page set up by the Incognito Market extortionists.</p></div>
<p>We&#8217;ll be publishing the entire dump of 557k orders and 862k crypto transaction IDs at the end of May, whether or not you and your customers&#8217; info is on that list is totally up to you. And yes, this is an extortion!!!!</p>
<p>Incognito Market said it plans to open up a &#8220;whitelist portal&#8221; for buyers to remove their transaction records &#8220;in a few weeks.&#8221;<span id="more-66726"></span></p>
<p>The mass-extortion of Incognito Market users comes just days after a large number of users reported they were no longer able to withdraw funds from their buyer or seller accounts. The cryptocurrency-focused publication <strong>Cointelegraph.com</strong> <a href="https://cointelegraph.com/news/bitcoin-monero-reportedly-stolen-darknet-market-exit-scam" target="_blank" rel="noopener">reported Mar. 6</a> that Incognito was exit-scamming its users out of their bitcoins and Monero deposits.</p>
<p>CoinTelegraph notes that Incognito Market administrators initially lied about the situation, and blamed users&#8217; difficulties in withdrawing funds on recent changes to Incognito&#8217;s withdrawal systems.</p>
<p>Incognito Market deals primarily in narcotics, so it&#8217;s likely many users are now worried about being outed as drug dealers. Creating a new account on Incognito Market presents one with an ad for 5 grams of heroin selling for $450.</p>
<div id="attachment_66730" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66730" decoding="async" loading="lazy" class=" wp-image-66730" src="media/e8663876.incognito-heroin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin.png" alt="" width="749" height="558" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin.png 913w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin-768x572.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin-782x582.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66730" class="wp-caption-text">New Incognito Market users are treated to an ad for $450 worth of heroin.</p></div>
<p>The double whammy now hitting Incognito Market users is somewhat akin to the double extortion techniques employed by many modern ransomware groups, wherein victim organizations are hacked, relieved of sensitive information and then presented with two separate ransom demands: One in exchange for a digital key needed to unlock infected systems, and another to secure a promise that any stolen data will not be published or sold, and will be destroyed.</p>
<p>Incognito Market has priced its extortion for vendors based on their status or &#8220;level&#8221; within the marketplace. Level 1 vendors can supposedly have their information removed by paying a $100 fee. However, larger &#8220;Level 5&#8221; vendors are asked to cough up $20,000 payments.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66733" src="media/9011dff0.extortionprices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices.png" alt="" width="750" height="240" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices.png 863w, https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices-768x246.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices-782x250.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>The past is replete with examples of similar darknet market exit scams, which tend to happen eventually to all darknet markets that aren&#8217;t seized and shut down by federal investigators, said <strong>Brett Johnson</strong>, a convicted and reformed cybercriminal who built the organized cybercrime community Shadowcrew many years ago.</p>
<p>&#8220;Shadowcrew was the precursor to today&#8217;s Darknet Markets and laid the foundation for the way modern cybercrime channels still operate today,&#8221; Johnson said. &#8220;The Truth of Darknet Markets? ALL of them are Exit Scams. The only question is whether law enforcement can shut down the market and arrest its operators before the exit scam takes place.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66578
title: Patch Tuesday, March 2024 Edition
uri: Patch-Tuesday-March-2024-Edition
url: https://krebsonsecurity.com/2024/03/patch-tuesday-march-2024-edition/
content:
<p><strong>Apple</strong> and <strong>Microsoft</strong> recently released software updates to fix dozens of security holes in their operating systems. Microsoft today patched at least 60 vulnerabilities in its <strong>Windows OS</strong>. Meanwhile, Apple&#8217;s new <strong>macOS Sonoma</strong> addresses at least 68 security weaknesses, and its latest updates for iOS fixes two zero-day flaws.</p>
<p><img decoding="async" class="size-full wp-image-66741 aligncenter" src="media/4ab005b7.macOS-ios.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/macOS-ios.png" alt="" width="618" height="409" /></p>
<p>Last week, Apple pushed out an urgent software update to its flagship iOS platform, <a href="https://securityweek.com/apple-blunts-zero-day-attacks-with-ios-17-4-update/" target="_blank" rel="noopener">warning</a> that there were at least two zero-day exploits for vulnerabilities being used in the wild (CVE-2024-23225 and CVE-2024-23296). The security updates are available in <strong>iOS 17.4</strong>, <strong>iPadOS 17.4</strong>, and <strong>iOS 16.7.6</strong>.</p>
<p>Apple&#8217;s <strong>macOS</strong> <strong>Sonoma 14.4 Security Update</strong> addresses dozens of security issues. <strong>Jason Kitka</strong>, chief information security officer at <strong>Automox</strong>, said the vulnerabilities patched in this update often stem from memory safety issues, a concern that has led to a broader industry conversation about the adoption of memory-safe programming languages [full disclosure: Automox is an advertiser on this site].</p>
<p>On Feb. 26, 2024, the Biden administration <a href="https://www.whitehouse.gov/oncd/briefing-room/2024/02/26/memory-safety-statements-of-support/" target="_blank" rel="noopener">issued a report</a> that calls for greater adoption of memory-safe programming languages. On Mar. 4, 2024, Google published <a href="https://security.googleblog.com/2024/03/secure-by-design-googles-perspective-on.html" target="_blank" rel="noopener">Secure by Design</a>, which lays out the company&#8217;s perspective on memory safety risks.</p>
<p>Mercifully, there do not appear to be any zero-day threats hounding Windows users this month (at least not yet). <strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, notes that of the 60 CVEs in this month’s Patch Tuesday release, only six are considered &#8220;more likely to be exploited&#8221; according to Microsoft.</p>
<p>Those more likely to be exploited bugs are mostly &#8220;elevation of privilege vulnerabilities&#8221; including <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-26182" target="_blank" rel="noopener">CVE-2024-26182</a> (Windows Kernel), <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-26170" target="_blank" rel="noopener">CVE-2024-26170</a> (Windows Composite Image File System (CimFS), <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21437" target="_blank" rel="noopener">CVE-2024-21437</a> (Windows Graphics Component), and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21433" target="_blank" rel="noopener">CVE-2024-21433</a> (Windows Print Spooler).</p>
<p>Narang highlighted <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21390" target="_blank" rel="noopener">CVE-2024-21390</a> as a particularly interesting vulnerability in this month’s Patch Tuesday release, which is an elevation of privilege flaw in <strong>Microsoft Authenticator</strong>, the software giant&#8217;s app for multi-factor authentication. Narang said a prerequisite for an attacker to exploit this flaw is to already have a presence on the device either through malware or a malicious application.<span id="more-66578"></span></p>
<p>&#8220;If a victim has closed and re-opened the Microsoft Authenticator app, an attacker could obtain multi-factor authentication codes and modify or delete accounts from the app,&#8221; Narang said. &#8220;Having access to a target device is bad enough as they can monitor keystrokes, steal data and redirect users to phishing websites, but if the goal is to remain stealth, they could maintain this access and steal multi-factor authentication codes in order to login to sensitive accounts, steal data or hijack the accounts altogether by changing passwords and replacing the multi-factor authentication device, effectively locking the user out of their accounts.&#8221;</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21334" target="_blank" rel="noopener">CVE-2024-21334</a> earned a CVSS (danger) score of 9.8 (1o is the worst), and it concerns a weakness in <strong>Open Management Infrastructure</strong> (OMI), a Linux-based cloud infrastructure in <strong>Microsoft Azure</strong>. Microsoft says attackers could connect to OMI instances over the Internet without authentication, and then send specially crafted data packets to gain remote code execution on the host device.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21435" target="_blank" rel="noopener">CVE-2024-21435</a> is a CVSS 8.8 vulnerability in Windows OLE, which acts as a kind of backbone for a great deal of communication between applications that people use every day on Windows, said <strong>Kevin Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>.</p>
<p>&#8220;With this vulnerability, there is an exploit that allows remote code execution, the attacker needs to trick a user into opening a document, this document will exploit the OLE engine to download a malicious DLL to gain code execution on the system,&#8221; Breen explained. &#8220;The attack complexity has been described as low meaning there is less of a barrier to entry for attackers.&#8221;</p>
<p>A full list of the vulnerabilities addressed by Microsoft this month is available at the <a href="https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+March+2024/30736/" target="_blank" rel="noopener">SANS Internet Storm Center</a>, which breaks down the updates by severity and urgency.</p>
<p>Finally, Adobe today issued security updates that fix dozens of security holes in a wide range of products, including <strong>Adobe Experience Manager</strong>, <strong>Adobe Premiere Pro</strong>, <strong>ColdFusion 2023</strong> and <strong>2021</strong>, <strong>Adobe Bridge</strong>, <strong>Lightroom</strong>, and <strong>Adobe Animate</strong>. Adobe said it is not aware of active exploitation against any of the flaws.</p>
<p>By the way, Adobe recently enrolled all of its <strong>Acrobat</strong> users into a &#8220;new generative AI feature&#8221; that scans the contents of your PDFs so that its new &#8220;AI Assistant&#8221; can  &#8220;understand your questions and provide responses based on the content of your PDF file.&#8221; Adobe provides instructions on how to disable the AI features and opt out <a href="https://helpx.adobe.com/acrobat/using/disable-generative-ai.html" target="_blank" rel="noopener">here</a>.</p>
<p><img decoding="async" loading="lazy" class="size-full wp-image-66740 aligncenter" src="media/35c9f7b8.adobe-ai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/adobe-ai.png" alt="" width="571" height="738" /></p>


feed_id: https://krebsonsecurity.com/?p=66752
title: CEO of Data Privacy Company Onerep.com Founded Dozens of People-Search Firms
uri: CEO-of-Data-Privacy-Company-Onerep-com-Founded-Dozens-of-People-Search
url:
https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/

content:
<p>The data privacy company <strong>Onerep.com</strong> bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and Cyprus, and that its founder has launched dozens of people-search services over the years.</p>
<p>Onerep&#8217;s &#8220;Protect&#8221; service starts at $8.33 per month for individuals and $15/mo for families, and promises to remove your personal information from nearly 200 people-search sites. Onerep also markets its service to companies seeking to offer their employees the ability to have their data continuously removed from people-search sites.</p>
<div id="attachment_66754" style="width: 260px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66754" decoding="async" class=" wp-image-66754" src="media/3d6b31cf.onerep-permanente.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-permanente.png" alt="" width="250" height="436" /><p id="caption-attachment-66754" class="wp-caption-text">A testimonial on onerep.com.</p></div>
<p>Customer case studies published on onerep.com state that it struck a deal to offer the service to employees of <strong>Permanente Medicine</strong>, which represents the doctors within the health insurance giant <strong>Kaiser Permanente</strong>. Onerep also says it has made inroads among police departments in the United States.</p>
<p>But a review of Onerep&#8217;s domain registration records and that of its founder reveal a different side to this company. Onerep.com says its founder and CEO is <strong>Dimitri Shelest</strong> from Minsk, Belarus, as does <a href="https://www.linkedin.com/in/dimitri-shelest-183626174/" target="_blank" rel="noopener">Shelest&#8217;s profile on LinkedIn</a>. Historic registration records indexed by <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> say Mr. Shelest was a registrant of onerep.com who used the email address <strong>dmitrcox2@gmail.com</strong>.</p>
<p>A search in the data breach tracking service <a href="https://constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> for the name Dimitri Shelest brings up the email address <strong>dimitri.shelest@onerep.com</strong>. Constella also finds that Dimitri Shelest from Belarus used the email address <strong>d.sh@nuwber.com</strong>, and the Belarus phone number <strong>+375-292-702786</strong>.</p>
<p>Nuwber.com is a people search service whose employees all appear to be from Belarus, and it is one of dozens of people-search companies that Onerep claims to target with its data-removal service. Onerep.com&#8217;s website disavows any relationship to Nuwber.com, stating quite clearly, &#8220;Please note that OneRep is not associated with Nuwber.com.&#8221;</p>
<p>However, there is an abundance of evidence suggesting Mr. Shelest is in fact the founder of Nuwber. Constella found that Minsk telephone number (375-292-702786) has been used multiple times in connection with the email address <strong>dmitrcox@gmail.com</strong>. Recall that Onerep.com&#8217;s domain registration records in 2018 list the email address dmitrcox2@gmail.com.</p>
<p>It appears Mr. Shelest sought to reinvent his online identity in 2015 by adding a &#8220;2&#8221; to his email address. A search on the Belarus phone number tied to Nuwber.com shows up in the domain records for <strong>askmachine.org</strong>, and DomainTools says this domain is tied to both dmitrcox@gmail.com and dmitrcox2@gmail.com.</p>
<div id="attachment_66783" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66783" decoding="async" loading="lazy" class=" wp-image-66783" src="media/4cc78458.onerep-shellest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png" alt="" width="749" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png 1275w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-768x450.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-782x458.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66783" class="wp-caption-text">Onerep.com CEO and founder Dimitri Shelest, as pictured on the &#8220;about&#8221; page of onerep.com.</p></div>
<p>A search in DomainTools for the email address dmitrcox@gmail.com shows it is associated with the registration of at least 179 domain names, including dozens of mostly now-defunct people-search companies targeting citizens of Argentina, Brazil, Canada, Denmark, France, Germany, Hong Kong, Israel, Italy, Japan, Latvia and Mexico, among others.</p>
<p>Those include <a href="https://web.archive.org/web/20160324064030/https://nuwber.fr/" target="_blank" rel="noopener"><strong>nuwber.fr</strong></a>, a site registered in 2016 which was identical to <a href="https://web.archive.org/web/20160616212526/https://nuwber.com/" target="_blank" rel="noopener">the homepage of Nuwber.com at the time</a>. DomainTools shows the same email and Belarus phone number are in historic registration records for <a href="https://web.archive.org/web/20170709170147/https://nuwber.at/" target="_blank" rel="noopener">nuwber.at</a>, <a href="https://web.archive.org/web/20160804065746/https://nuwber.ch/" target="_blank" rel="noopener">nuwber.ch</a>, and <a href="https://web.archive.org/web/20160806212859/https://nuwber.dk/" target="_blank" rel="noopener">nuwber.dk</a> (all domains linked here are to their cached copies at archive.org, where available).</p>
<div id="attachment_66755" style="width: 759px" class="wp-caption aligncenter"><a href="media/9041886c.nuwber-dot-com.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66755" decoding="async" loading="lazy" class="wp-image-66755" src="media/9041886c.nuwber-dot-com.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com.png" alt="" width="749" height="477" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com.png 1436w, https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com-768x489.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com-782x498.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-66755" class="wp-caption-text">Nuwber.com, circa 2015. Image: Archive.org.</p></div>
<p>A review of historic WHOIS records for onerep.com show it was registered for many years to a resident of Sioux Falls, SD for a completely unrelated site. But around Sept. 2015 the domain switched from the registrar GoDaddy.com to eNom, and the registration records were hidden behind privacy protection services. DomainTools indicates around this time onerep.com started using domain name servers from DNS provider constellix.com. Likewise, Nuwber.com first appeared in late 2015, was also registered through eNom, and also started using constellix.com for DNS at nearly the same time.</p>
<p>Listed <a href="https://www.linkedin.com/in/dzmitrybukuyazau/" target="_blank" rel="noopener">on LinkedIn</a> as a former product manager at OneRep.com between 2015 and 2018 is <strong>Dimitri Bukuyazau</strong>, who says their hometown is Warsaw, Poland. While this LinkedIn profile (linkedin.com/in/<strong>dzmitry</strong>bukuyazau) does not mention Nuwber, a search on this name in Google turns up <a href="https://web.archive.org/web/20200906155823/https://www.privacyduck.com/comparisons/privacyduck-vs-onerep-com-the-eastern-european-privacy-company/" target="_blank" rel="noopener">a 2017 blog post from privacyduck.com</a>, which laid out a number of reasons to support a conclusion that OneRep and Nuwber.com were the same company.</p>
<p>&#8220;Any people search profiles containing your Personally Identifiable Information that were on Nuwber.com were also mirrored identically on OneRep.com, down to the relatives’ names and address histories,&#8221; Privacyduck.com wrote. The post continued:</p>
<blockquote><p>&#8220;Both sites offered the same immediate opt-out process. Both sites had the same generic contact and support structure. They were &#8211; and remain &#8211; the same company (even PissedConsumer.com advocates this fact: https://nuwber.pissedconsumer.com/nuwber-and-onerep-20160707878520.html).&#8221;</p>
<p>&#8220;Things changed in early 2016 when OneRep.com began offering privacy removal services right alongside their own open displays of your personal information. At this point when you found yourself on Nuwber.com OR OneRep.com, you would be provided with the option of opting-out your data on their site for free &#8211; but also be highly encouraged to pay them to remove it from a slew of other sites (and part of that payment was removing you from their own site, Nuwber.com, as a benefit of their service).&#8221;</p></blockquote>
<p>Reached via LinkedIn, Mr. Bukuyazau declined to answer questions, such as whether he ever worked at Nuwber.com. However, Constella Intelligence finds two interesting email addresses for employees at nuwber.com: d.bu@nuwber.com, and d.bu+figure-eight.com@nuwber.com, which was registered under the name &#8220;<strong>Dzmitry</strong>.&#8221;</p>
<p>PrivacyDuck&#8217;s claims about how onerep.com appeared and behaved in the early days are not readily verifiable because the domain onerep.com has been completely excluded from the Wayback Machine at archive.org. The Wayback Machine will honor such requests if they come directly from the owner of the domain in question.</p>
<p>Still, Mr. Shelest&#8217;s name, phone number and email also appear in the domain registration records for a truly dizzying number of country-specific people-search services, including <strong>pplcrwlr.in</strong>, <a href="https://web.archive.org/web/20150205232653/http://pplcrwlr.fr/" target="_blank" rel="noopener">pplcrwlr.fr</a>, <a href="https://web.archive.org/web/20150206043953/http://pplcrwlr.dk/" target="_blank" rel="noopener">pplcrwlr.dk</a>, <a href="https://web.archive.org/web/20150206005352/http://pplcrwlr.jp/" target="_blank" rel="noopener">pplcrwlr.jp</a>, <strong>peeepl.br.com</strong>, <strong>peeepl.in</strong>, <a href="https://web.archive.org/web/20130307194029/http://peeepl.it/" target="_blank" rel="noopener">peeepl.it</a> and <a href="https://web.archive.org/web/20140320054902/http://peeepl.co.uk/" target="_blank" rel="noopener">peeepl.co.uk</a>.</p>
<p>The same details appear in the WHOIS registration records for the now-defunct people-search sites <a href="https://web.archive.org/web/20140208014115/http://waatpp.de/" target="_blank" rel="noopener">waatpp.de</a>, <a href="https://web.archive.org/web/20150205232901/http://waatp1.fr/" target="_blank" rel="noopener">waatp1.fr</a>, <a href="https://web.archive.org/web/20120112131753/http://azersab.com/" target="_blank" rel="noopener">azersab.com</a>, and <a href="https://web.archive.org/web/20120507115825/http://ahavoila.com/" target="_blank" rel="noopener">ahavoila.com</a>, a people-search service for French citizens.<span id="more-66752"></span></p>
<div id="attachment_66756" style="width: 760px" class="wp-caption aligncenter"><a href="media/af7fed4c.waatp-de.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66756" decoding="async" loading="lazy" class="wp-image-66756" src="media/af7fed4c.waatp-de.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66756" class="wp-caption-text">The German people-search site waatp.de.</p></div>
<p>A search on the email address dmitrcox@gmail.com suggests Mr. Shelest was previously involved in rather aggressive email marketing campaigns. In 2010, an anonymous source <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">leaked to KrebsOnSecurity</a> the financial and organizational records of <a href="https://krebsonsecurity.com/tag/spamit/" target="_blank" rel="noopener"><strong>Spamit</strong></a>, which at the time was easily the largest Russian-language pharmacy spam affiliate program in the world.</p>
<p>Spamit paid spammers a hefty commission every time someone bought male enhancement drugs from any of their spam-advertised websites. Mr. Shelest&#8217;s email address stood out because immediately after the Spamit database was leaked, KrebsOnSecurity searched all of the Spamit affiliate email addresses to determine if any of them corresponded to social media accounts at <strong>Facebook.com</strong> (at the time, Facebook allowed users to search profiles by email address).</p>
<p>That mapping, which was done mainly by generous graduate students at my alma mater <strong>George Mason University</strong>, revealed that dmitrcox@gmail.com was used by a Spamit affiliate, albeit not a very profitable one. That same <a href="https://www.facebook.com/dmitry.shelest" target="_blank" rel="noopener">Facebook profile for Mr. Shelest</a> is still active, and it says he is married and living in Minsk (last update: 2021).</p>
<div id="attachment_66757" style="width: 760px" class="wp-caption aligncenter"><a href="media/b4c3dfa1.peeepl.it_.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66757" decoding="async" loading="lazy" class="wp-image-66757" src="media/b4c3dfa1.peeepl.it_.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66757" class="wp-caption-text">The Italian people-search website peeepl.it.</p></div>
<p>Scrolling down Mr. Shelest&#8217;s Facebook page to posts made more than ten years ago show him liking the Facebook profile pages for a large number of other people-search sites, including <a href="https://web.archive.org/web/20120215164504/http://findita.com/" target="_blank" rel="noopener">findita.com</a>, <a href="https://web.archive.org/web/20120611000147/http://findmedo.com/" target="_blank" rel="noopener">findmedo.com</a>, <a href="https://web.archive.org/web/20120202191444/http://folkscan.com/" target="_blank" rel="noopener">folkscan.com</a>, <a href="https://web.archive.org/web/20120204021306/http://huntize.com/" target="_blank" rel="noopener">huntize.com</a>, <a href="https://web.archive.org/web/20120201003010/http://ifindy.com/" target="_blank" rel="noopener">ifindy.com</a>, <a href="https://web.archive.org/web/20130209191213/http://jupery.com/" target="_blank" rel="noopener">jupery.com</a>, <a href="https://web.archive.org/web/20120214040919/http://look2man.com/" target="_blank" rel="noopener">look2man.com</a>, <a href="https://web.archive.org/web/20130318231852/http://lookerun.com/" target="_blank" rel="noopener">lookerun.com</a>, <a href="https://web.archive.org/web/20120217181822/http://manyp.com/" target="_blank" rel="noopener">manyp.com</a>, peepull.com, <a href="https://web.archive.org/web/20130425195446/http://perserch.com/" target="_blank" rel="noopener">perserch.com</a>, <a href="https://web.archive.org/web/20140104023637/http://persuer.com/" target="_blank" rel="noopener">persuer.com</a>, <a href="https://web.archive.org/web/20121001072151/http://pervent.com/" target="_blank" rel="noopener">pervent.com</a>, <a href="https://web.archive.org/web/20130116123555/http://piplenter.com/" target="_blank" rel="noopener">piplenter.com</a>, <a href="https://web.archive.org/web/20120215174246/http://piplfind.com/" target="_blank" rel="noopener">piplfind.com</a>, <a href="https://web.archive.org/web/20130302034909/http://piplscan.com/" target="_blank" rel="noopener">piplscan.com</a>, <a href="https://web.archive.org/web/20110210162153/http://popopke.com/" target="_blank" rel="noopener">popopke.com</a>, <a href="https://web.archive.org/web/20120210030201/http://pplsorce.com/" target="_blank" rel="noopener">pplsorce.com</a>, <a href="https://web.archive.org/web/20130215180627/http://qimeo.com/" target="_blank" rel="noopener">qimeo.com</a>, <a href="https://web.archive.org/web/20120125085744/http://scoutu2.com/" target="_blank" rel="noopener">scoutu2.com</a>, <a href="https://web.archive.org/web/20120215092423/http://search64.com/" target="_blank" rel="noopener">search64.com</a>, <a href="https://web.archive.org/web/20120204035144/http://searchay.com/" target="_blank" rel="noopener">searchay.com</a>, <a href="https://web.archive.org/web/20120215082510/http://seekmi.com/" target="_blank" rel="noopener">seekmi.com</a>, <a href="https://web.archive.org/web/20120502175915/http://selfabc.com/" target="_blank" rel="noopener">selfabc.com</a>, <a href="https://web.archive.org/web/20120211043052/http://socsee.com/" target="_blank" rel="noopener">socsee.com</a>, <a href="https://web.archive.org/web/20130116150616/http://srching.com/" target="_blank" rel="noopener">srching.com</a>, <a href="https://web.archive.org/web/20120204100134/http://toolooks.com/" target="_blank" rel="noopener">toolooks.com</a>, <a href="https://web.archive.org/web/20120706142742/http://upearch.com/" target="_blank" rel="noopener">upearch.com</a>, <a href="https://web.archive.org/web/20120306122418/http://webmeek.com/" target="_blank" rel="noopener">webmeek.com</a>, and many country-code variations of <a href="https://web.archive.org/web/20131103141811/http://viadin.ca/" target="_blank" rel="noopener">viadin.ca</a> (e.g. <a href="https://web.archive.org/web/20130427065532/http://viadin.hk/" target="_blank" rel="noopener">viadin.hk</a>, <a href="https://web.archive.org/web/20130805064112/http://viadin.com/" target="_blank" rel="noopener">viadin.com</a> and <a href="https://web.archive.org/web/20130428035516/http://viadin.de/" target="_blank" rel="noopener">viadin.de</a>).</p>
<div id="attachment_66758" style="width: 760px" class="wp-caption aligncenter"><a href="media/9a568fa5.popoke.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66758" decoding="async" loading="lazy" class="wp-image-66758" src="media/9a568fa5.popoke.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66758" class="wp-caption-text">The people-search website popopke.com.</p></div>
<p>Domaintools.com finds that all of the domains mentioned in the last paragraph were registered to the email address dmitrcox@gmail.com.</p>
<p>Mr. Shelest has not responded to multiple requests for comment. KrebsOnSecurity also sought comment from onerep.com, which likewise has not responded to inquiries about its founder&#8217;s many apparent conflicts of interest. In any event, these practices would seem to contradict the goal Onerep has stated on its site: &#8220;We believe that no one should compromise personal online security and get a profit from it.&#8221;</p>
<div id="attachment_66759" style="width: 758px" class="wp-caption aligncenter"><a href="media/d9353cc1.findmedo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66759" decoding="async" loading="lazy" class="wp-image-66759" src="media/d9353cc1.findmedo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo.png" alt="" width="748" height="319" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo-768x327.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo-1536x654.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo-782x333.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-66759" class="wp-caption-text">The people-search website findmedo.com.</p></div>
<p><strong>Max Anderson</strong> is chief growth officer at <a href="https://www.360privacy.io/" rel="noopener" target="_blank">360 Privacy</a>, a legitimate privacy company that works to keep its clients&#8217; data off of more than 400 data broker and people-search sites. Anderson said it is concerning to see a direct link between between a data removal service and data broker websites. </p>
<p>&#8220;I would consider it unethical to run a company that sells people’s information, and then charge those same people to have their information removed,&#8221; Anderson said. </p>
<p>Last week, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">an analysis of the people-search data broker giant <strong>Radaris</strong></a>, whose consumer profiles are deep enough to rival those of far more guarded data broker resources available to U.S. police departments and other law enforcement personnel.</p>
<p>That story revealed that the co-founders of Radaris are two native Russian brothers who operate multiple Russian-language dating services and affiliate programs. It also appears many of the Radaris founders&#8217; businesses have ties to a California marketing firm that works with a Russian state-run media conglomerate currently sanctioned by the U.S. government.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66760" src="media/0bb4c1f1.search64.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/search64.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/search64.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/search64-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/search64-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/search64-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>KrebsOnSecurity will continue investigating the history of various consumer data brokers and people-search providers. If any readers have inside knowledge of this industry or key players within it, please consider reaching out to krebsonsecurity at gmail.com.</p>


feed_id: https://krebsonsecurity.com/?p=66799
title: The Not-so-True People-Search Network from China
uri: The-Not-so-True-People-Search-Network-from-China
url: https://krebsonsecurity.com/2024/03/the-not-so-true-people-search-network-from-china/
content:
<p>It&#8217;s not unusual for the data brokers behind people-search websites <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">to use pseudonyms</a> in their day-to-day lives (you would, too). Some of these personal data purveyors even try to <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">reinvent their online identities</a> in a bid to hide their conflicts of interest. But it&#8217;s not every day you run across a US-focused people-search network based in China whose principal owners all appear to be completely fabricated identities.</p>
<p>Responding to a reader inquiry concerning the trustworthiness of a site called <strong>TruePeopleSearch[.]net</strong>, KrebsOnSecurity began poking around. The site offers to sell reports containing photos, police records, background checks, civil judgments, contact information &#8220;and much more!&#8221; According to LinkedIn and numerous profiles on websites that accept paid article submissions, the founder of TruePeopleSearch is <strong>Marilyn Gaskell</strong> from Phoenix, Ariz.</p>
<div id="attachment_66803" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66803" decoding="async" class=" wp-image-66803" src="media/f14a365f.MarilynGaskell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell.png" alt="" width="749" height="338" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell-768x347.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell-782x353.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66803" class="wp-caption-text">The saucy yet studious LinkedIn profile for Marilyn Gaskell.</p></div>
<p>Ms. Gaskell has been quoted in multiple &#8220;articles&#8221; about random subjects, such as <a href="https://hrdailyadvisor.blr.com/2021/09/09/fantasy-football-a-workplace-distraction-or-team-building-activity/" target="_blank" rel="noopener">this article at HRDailyAdvisor</a> about the pros and cons of joining a company-led fantasy football team.</p>
<p>&#8220;Marilyn Gaskell, founder of TruePeopleSearch, agrees that not everyone in the office is likely to be a football fan and might feel intimidated by joining a company league or left out if they don’t join; however, her company looked for ways to make the activity more inclusive,&#8221; this paid story notes.</p>
<p>Also quoted in this article is <strong>Sally Stevens</strong>, who is cited as HR Manager at <strong>FastPeopleSearch[.]io</strong>.</p>
<div id="attachment_66805" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66805" decoding="async" loading="lazy" class=" wp-image-66805" src="media/3a5ad492.SallyStevens.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens.png" alt="" width="749" height="445" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens-768x456.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens-782x464.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66805" class="wp-caption-text">Sally Stevens, the phantom HR Manager for FastPeopleSearch.</p></div>
<p>&#8220;Fantasy football provides one way for employees to set aside work matters for some time and have fun,&#8221; Stevens contributed. &#8220;Employees can set a special league for themselves and regularly check and compare their scores against one another.&#8221;</p>
<p>Imagine that: Two different people-search companies mentioned in the same story about fantasy football. What are the odds?</p>
<p>Both TruePeopleSearch and FastPeopleSearch allow users to search for reports by first and last name, but proceeding to order a report prompts the visitor to purchase the file from one of several established people-finder services, including <strong>BeenVerified,</strong> <strong>Intelius</strong>, and<strong> Spokeo.</strong></p>
<p><strong>DomainTools.com</strong> shows that both TruePeopleSearch and FastPeopleSearch appeared around 2020 and were registered through <strong>Alibaba Cloud</strong>, in Beijing, China. No other information is available about these domains in their registration records, although both domains appear to use email servers based in China.</p>
<p>Sally Stevens&#8217; LinkedIn profile photo is identical to a stock image titled &#8220;beautiful girl&#8221; from Adobe.com. Ms. Stevens is also quoted in <a href="https://ecogreenequipment.com/sustainable-business-practices-make-your-products-more-attractive/" target="_blank" rel="noopener">a paid blog post at ecogreenequipment.com</a>, as is <strong>Alina Clark</strong>, co-founder and marketing director of <strong>CocoDoc</strong>, an online service for editing and managing PDF documents.</p>
<div id="attachment_66806" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66806" decoding="async" loading="lazy" class=" wp-image-66806" src="media/2ccefa89.AlinaClark.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark.png" alt="" width="750" height="388" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark-768x397.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark-782x404.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66806" class="wp-caption-text">The profile photo for Alina Clark is a stock photo appearing on more than 100 websites.</p></div>
<p>Scouring multiple image search sites reveals Ms. Clark&#8217;s profile photo on LinkedIn is another stock image that is currently on more than 100 different websites, including Adobe.com. Cocodoc[.]com was registered in June 2020 via Alibaba Cloud Beijing in China.</p>
<p>The same Alina Clark and photo materialized in a paid article at the website Ceoblognation, which in 2021 included her at #11 in a piece called &#8220;<a href="https://hear.ceoblognation.com/2021/12/03/30-entrepreneurs-describe-the-bhags-big-hairy-audacious-goals-for-their-business/#google_vignette" target="_blank" rel="noopener">30 Entrepreneurs Describe The Big Hairy Audacious Goals (BHAGs) for Their Business</a>.&#8221; It&#8217;s also worth noting that Ms. Clark is currently listed as a &#8220;<a href="https://www.forbes.com/sites/forbesbusinesscouncil/people/alinaclark/?sh=61e5d0ed3b20" target="_blank" rel="noopener">former Forbes Council member</a>&#8221; at the media outlet Forbes.com.<span id="more-66799"></span></p>
<p>Entrepreneur #6 is <strong>Stephen Curry</strong>, who is quoted as CEO of <strong>CocoSign[.]com</strong>, a website that claims to offer an &#8220;easier, quicker, safer eSignature solution for small and medium-sized businesses.&#8221; Incidentally, the same photo for Stephen Curry #6 is also used in this &#8220;article&#8221; for #22 <strong>Jake Smith</strong>, who is named as the owner of a different company.</p>
<div id="attachment_66807" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66807" decoding="async" loading="lazy" class="wp-image-66807" src="media/6215d4c5.StephenCurry.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry.png" alt="" width="748" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry-768x326.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry-782x332.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-66807" class="wp-caption-text">Stephen Curry, aka Jake Smith, aka no such person.</p></div>
<p><a href="https://www.linkedin.com/in/stephen-curry-2b6253218/" target="_blank" rel="noopener">Mr. Curry&#8217;s LinkedIn profile</a> shows a young man seated at a table in front of a laptop, but an online image search shows this is another stock photo. Cocosign[.]com was registered in June 2020 via Alibaba Cloud Beijing. No ownership details are available in the domain registration records.</p>
<p>Listed at #13 in that 30 Entrepreneurs article is <strong>Eden Cheng</strong>, who is cited as co-founder of <strong>PeopleFinderFree[.]com</strong>. KrebsOnSecurity could not find a LinkedIn profile for Ms. Cheng, but a search on her profile image from that Entrepreneurs article shows the same photo for sale at Shutterstock and other stock photo sites.</p>
<p>DomainTools says PeopleFinderFree was registered through Alibaba Cloud, Beijing. Attempts to purchase reports through PeopleFinderFree produce a notice saying the full report is only available via Spokeo.com.</p>
<p><strong>Lynda Fairly</strong> is Entrepreneur #24, and she is quoted as co-founder of <strong>Numlooker[.]com</strong>, a domain registered in April 2021 through Alibaba in China. Searches for people on Numlooker forward visitors to Spokeo.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66804" src="media/949474bc.LyndaFairly.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly.png" alt="" width="750" height="503" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly-768x515.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly-782x525.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>The photo next to Ms. Fairly&#8217;s quote in Entrepreneurs matches that of <a href="https://www.linkedin.com/in/lynda-fairly-2a3b10217/" target="_blank" rel="noopener">a LinkedIn profile for Lynda Fairly</a>. But a search on that photo shows this same portrait has been used by many other identities and names, including a woman from the United Kingdom who&#8217;s a cancer survivor and mother of five; a licensed marriage and family therapist in Canada; a software security engineer at Quora; a journalist on Twitter/X; and a marketing expert in Canada.</p>
<p><strong>Cocofinder[.]com</strong> is a people-search service that launched in Sept. 2019, through Alibaba in China. Cocofinder lists its market officer as <strong>Harriet Chan</strong>, but <a href="https://www.linkedin.com/in/harriet-chan-92196a207/" target="_blank" rel="noopener">Ms. Chan&#8217;s LinkedIn profile</a> is just as sparse on work history as the other people-search owners mentioned already. An image search online shows that outside of LinkedIn, the profile photo for Ms. Chan has only ever appeared in articles at pay-to-play media sites, like <a href="https://www.outbackteambuilding.com/blog/examples-of-soft-skills-for-leaders/" target="_blank" rel="noopener">this one</a> from outbackteambuilding.com.</p>
<p>Perhaps because Cocodoc and Cocosign both sell software services, they are actually tied to a physical presence in the real world &#8212; in Singapore (15 Scotts Rd. #03-12 15, Singapore). But it&#8217;s difficult to discern much from this address alone.</p>
<p>Who&#8217;s behind all this people-search chicanery? A January 2024 review of various people-search services at the website techjury.com states that Cocofinder is a wholly-owned subsidiary of a Chinese company called <strong>Shenzhen Duiyun Technology Co.</strong></p>
<p>&#8220;Though it only finds results from the United States, users can choose between four main search methods,&#8221; Techjury explains. Those include people search, phone, address and email lookup. This claim is supported by <a href="https://www.reddit.com/r/PSA/comments/nga6os/cocofinder_people_search_background_check/" target="_blank" rel="noopener">a Reddit post from three years ago</a>, wherein the Reddit user &#8220;ProtectionAdvanced&#8221; named the same Chinese company.</p>
<p>Is Shenzhen Duiyun Technology Co. responsible for all these phony profiles? How many more fake companies and profiles are connected to this scheme? KrebsOnSecurity found other examples that didn&#8217;t appear directly tied to other fake executives listed here, but which nevertheless are registered through Alibaba and seek to drive traffic to Spokeo and other data brokers. For example, there&#8217;s the winsome <a href="https://enterprenuer.org/founders/meet-daniela-sawyer-founder-of-findpeoplefast/" target="_blank" rel="noopener">Daniela Sawyer</a>, founder of <strong>FindPeopleFast[.]net</strong>, whose profile is flogged in paid stories at entrepreneur.org.</p>
<p>Google currently turns up nothing else for in a search for Shenzhen Duiyun Technology Co. Please feel free to sound off in the comments if you have any more information about this entity, such as how to contact it. Or reach out directly at krebsonsecurity @ gmail.com.</p>
<div id="attachment_66852" style="width: 760px" class="wp-caption aligncenter"><a href="media/962c76c4.mm-tps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66852" decoding="async" loading="lazy" class="wp-image-66852" src="media/962c76c4.mm-tps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps.png" alt="" width="750" height="329" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps.png 1638w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps-768x337.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps-1536x673.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps-782x343.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66852" class="wp-caption-text">A mind map highlighting the key points of research in this story. Click to enlarge. Image: KrebsOnSecurity.com</p></div>
<h2>ANALYSIS</h2>
<p>It appears the purpose of this network is to conceal the location of people in China who are seeking to generate affiliate commissions when someone visits one of their sites and purchases a people-search report at Spokeo, for example. And it is clear that Spokeo and others have created incentives wherein anyone can effectively white-label their reports, and thereby make money brokering access to peoples&#8217; personal information.</p>
<p>Spokeo&#8217;s Wikipedia page says the company was founded in 2006 by four graduates from Stanford University. Spokeo co-founder and current <strong>CEO Harrison Tang</strong> has not yet responded to requests for comment.</p>
<p>Intelius is owned by San Diego based <strong>PeopleConnect Inc.</strong>, which also owns <strong>Classmates.com</strong>, <strong>USSearch</strong>, <strong>TruthFinder</strong> and <strong>Instant Checkmate</strong>. PeopleConnect Inc. in turn is owned by <strong>H.I.G. Capital</strong>, a $60 billion private equity firm. Requests for comment were sent to H.I.G. Capital. This story will be updated if they respond.</p>
<p>BeenVerified is owned by a New York City based holding company called <strong>The Lifetime Value Co.</strong>, a marketing and advertising firm whose <a href="https://www.ltvco.com/brands/" target="_blank" rel="noopener">brands</a> include <strong>PeopleLooker</strong>, <strong>NeighborWho</strong>, <strong>Ownerly</strong>, <strong>PeopleSmart</strong>, <strong>NumberGuru</strong>, and <strong>Bumper</strong>, a car history site.</p>
<p><strong>Ross Cohen</strong>, chief operating officer at The Lifetime Value Co., said it&#8217;s likely the network of suspicious people-finder sites was set up by an affiliate. Cohen said Lifetime Value would investigate to determine if this particular affiliate was driving them any sign-ups.</p>
<p>All of the above people-search services operate similarly. When you find the person you&#8217;re looking for, you are put through a lengthy (often 10-20 minute) series of splash screens that require you to agree that these reports won&#8217;t be used for employment screening or in evaluating new tenant applications. Still more prompts ask if you are okay with seeing &#8220;potentially shocking&#8221; details about the subject of the report, including arrest histories and photos.</p>
<p>Only at the end of this process does the site disclose that viewing the report in question requires signing up for a monthly subscription, which is typically priced around $35. Exactly how and from where these major people-search websites are getting their consumer data &#8212; and customers &#8212; will be the subject of further reporting here.</p>
<p>The main reason these various people-search sites require you to affirm that you won&#8217;t use their reports for hiring or vetting potential tenants is that selling reports for those purposes would classify these firms as consumer reporting agencies (CRAs) and expose them to regulations under the <a href="https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act" target="_blank" rel="noopener">Fair Credit Reporting Act</a> (FCRA).</p>
<p>These data brokers do not want to be treated as CRAs, and for this reason their people search reports typically don&#8217;t include detailed credit histories, financial information, or full Social Security Numbers (Radaris reports include the first six digits of one’s SSN).</p>
<p>But in September 2023, the <strong>U.S. Federal Trade Commission</strong> <a href="https://www.ftc.gov/news-events/news/press-releases/2023/09/ftc-says-truthfinder-instant-checkmate-deceived-users-about-background-report-accuracy-violated-fcra" target="_blank" rel="noopener">found</a> that TruthFinder and Instant Checkmate were trying to have it both ways. The FTC levied a $5.8 million penalty against the companies for allegedly acting as CRAs because they assembled and compiled information on consumers into background reports that were marketed and sold for employment and tenant screening purposes.</p>
<p>The FTC also found TruthFinder and Instant Checkmate deceived users about background report accuracy. The FTC alleges these companies made millions from their monthly subscriptions using push notifications and marketing emails that claimed that the subject of a background report had a criminal or arrest record, when the record was merely a traffic ticket.</p>
<p>The FTC said both companies deceived customers by providing “Remove” and “Flag as Inaccurate” buttons that did not work as advertised. Rather, the “Remove” button removed the disputed information only from the report as displayed to that customer; however, the same item of information remained visible to other customers who searched for the same person.</p>
<p>The FTC also said that when a customer flagged an item in the background report as inaccurate, the companies never took any steps to investigate those claims, to modify the reports, or to flag to other customers that the information had been disputed.</p>
<p>There are a growing number of online reputation management companies that offer to help customers remove their personal information from people-search sites and data broker databases. There are, no doubt, plenty of honest and well-meaning companies operating in this space, but it has been my experience that a great many people involved in that industry have a background in marketing or advertising &#8212; not privacy.</p>
<p>Also, some so-called data privacy companies may be wolves in sheep&#8217;s clothing. On March 14, KrebsOnSecurity published an abundance of evidence indicating that the CEO and founder of the data privacy company <strong>OneRep.com</strong> <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">was responsible for launching dozens of people-search services over the years</a>.</p>
<p>Finally, some of the more popular people-search websites are notorious for ignoring requests from consumers seeking to remove their information, regardless of which reputation or removal service you use. Some force you to create an account and provide more information before you can remove your data. Even then, the information you worked hard to remove may simply reappear a few months later.</p>
<p>This aptly describes countless complaints lodged against the data broker and people search giant <strong>Radaris</strong>. On March 8, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">profiled the co-founders of Radaris</a>, two Russian brothers in Massachusetts who also operate multiple Russian-language dating services and affiliate programs.</p>
<p>The truth is that these people-search companies will continue to thrive unless and until Congress begins to realize it&#8217;s time for some consumer privacy and data protection laws that are relevant to life in the 21st century. Duke University adjunct professor <strong>Justin Sherman</strong> says virtually all state privacy laws exempt records that might be considered &#8220;public&#8221; or &#8220;government&#8221; documents, including voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more.</p>
<p>“Consumer privacy laws in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia all contain highly similar or completely identical carve-outs for ‘publicly available information’ or government records,” Sherman said.</p>


feed_id: https://krebsonsecurity.com/?p=66866
title: Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
uri: Mozilla-Drops-Onerep-After-CEO-Admits-to-Running-People-Search-Network
url:
https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-after-ceo-admits-to-running-people-search-networks/

content:
<p>The nonprofit organization that supports the <strong>Firefox</strong> web browser said today it is winding down its new partnership with <strong>Onerep</strong>, an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity forced Onerep&#8217;s CEO to admit that he has founded dozens of people-search networks over the years.</p>
<div id="attachment_66872" style="width: 759px" class="wp-caption aligncenter"><a href="media/ef1768df.mozillamonitor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66872" decoding="async" class="wp-image-66872" src="media/ef1768df.mozillamonitor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor.png" alt="" width="749" height="379" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor.png 1185w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor-768x389.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor-782x396.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-66872" class="wp-caption-text">Mozilla Monitor. Image Mozilla Monitor Plus video on Youtube.</p></div>
<p><strong>Mozilla</strong> only began bundling Onerep in Firefox last month, when it announced the reputation service would be offered on a subscription basis as part of <a href="https://www.mozilla.org/en-US/about/legal/terms/subscription-services/" target="_blank" rel="noopener">Mozilla Monitor Plus</a>. Launched in 2018 under the name <a href="https://en.wikipedia.org/wiki/Firefox_Monitor" target="_blank" rel="noopener">Firefox Monitor</a>, Mozilla Monitor also checks data from the website <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">Have I Been Pwned?</a> to let users know when their email addresses or password are leaked in data breaches.</p>
<p>On March 14, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">published a story</a> showing that Onerep&#8217;s Belarusian CEO and founder <strong>Dimitiri Shelest</strong> launched dozens of people-search services since 2010, including a still-active data broker called <strong>Nuwber</strong> that sells background reports on people. Onerep and Shelest did not respond to requests for comment on that story.</p>
<p>But on March 21, Shelest released a lengthy statement wherein he admitted to maintaining an ownership stake in Nuwber, a consumer data broker he founded in 2015 &#8212; around the same time he launched Onerep.</p>
<p>Shelest maintained that Nuwber has &#8220;zero cross-over or information-sharing with Onerep,&#8221; and said any other old domains that may be found and associated with his name are no longer being operated by him.</p>
<p>&#8220;I get it,&#8221; Shelest wrote. &#8220;My affiliation with a people search business may look odd from the outside. In truth, if I hadn’t taken that initial path with a deep dive into how people search sites work, Onerep wouldn’t have the best tech and team in the space. Still, I now appreciate that we did not make this more clear in the past and I’m aiming to do better in the future.&#8221; The full statement is available <a href="media/6f106324.Dimitri-Shelest-Letter-_-Comment-on-Krebs-article-3.20.24-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/Dimitri-Shelest-Letter-_-Comment-on-Krebs-article-3.20.24-1.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<div id="attachment_66783" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66783" decoding="async" loading="lazy" class=" wp-image-66783" src="media/4cc78458.onerep-shellest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png" alt="" width="749" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png 1275w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-768x450.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-782x458.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66783" class="wp-caption-text">Onerep CEO and founder Dimitri Shelest.</p></div>
<p>In a statement released today, a spokesperson for Mozilla said it was moving away from Onerep as a service provider in its Monitor Plus product.</p>
<p>&#8220;Though customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values,&#8221; Mozilla wrote. &#8220;We’re working now to solidify a transition plan that will provide customers with a seamless experience and will continue to put their interests first.&#8221;<span id="more-66866"></span></p>
<p>KrebsOnSecurity also reported that Shelest&#8217;s email address was used circa 2010 by an affiliate of <a href="https://krebsonsecurity.com/?s=spamit" target="_blank" rel="noopener">Spamit</a>, a Russian-language organization that paid people to aggressively promote websites hawking male enhancement drugs and generic pharmaceuticals. As noted in the March 14 story, this connection was confirmed by research from multiple graduate students at my alma mater George Mason University.</p>
<p>Shelest denied ever being associated with Spamit. &#8220;Between 2010 and 2014, we put up some web pages and optimize them &#8212; a widely used SEO practice &#8212; and then ran AdSense banners on them,&#8221; Shelest said, presumably referring to the dozens of people-search domains KrebsOnSecurity found were connected to his email addresses (dmitrcox@gmail.com and dmitrcox2@gmail.com). &#8220;As we progressed and learned more, we saw that a lot of the inquiries coming in were for people.&#8221;</p>
<p>Shelest also acknowledged that Onerep pays to run ads on &#8220;on a handful of data broker sites in very specific circumstances.&#8221;</p>
<p>&#8220;Our ad is served once someone has manually completed an opt-out form on their own,&#8221; Shelest wrote. &#8220;The goal is to let them know that if they were exposed on that site, there may be others, and bring awareness to there being a more automated opt-out option, such as Onerep.&#8221;</p>
<p>Reached via Twitter/X, HaveIBeenPwned founder <a href="https://twitter.com/troyhunt" target="_blank" rel="noopener">Troy Hunt</a> said he knew Mozilla was considering a partnership with Onerep, but that he was previously unaware of the Onerep CEO&#8217;s many conflicts of interest.</p>
<p>&#8220;I knew Mozilla had this in the works and we&#8217;d casually discussed it when talking about Firefox monitor,&#8221; Hunt told KrebsOnSecurity. &#8220;The point I made to them was the same as I’ve made to various companies wanting to put data broker removal ads on HIBP: removing your data from legally operating services has minimal impact, and you can’t remove it from the outright illegal ones who are doing the genuine damage.&#8221;</p>
<p>Playing both sides &#8212; creating and spreading the same digital disease that your medicine is designed to treat &#8212; may be highly unethical and wrong. But in the United States it&#8217;s not against the law. Nor is collecting and selling data on Americans. Privacy experts say the problem is that data brokers, people-search services like Nuwber and Onerep, and online reputation management firms exist because virtually all U.S. states exempt so-called &#8220;public&#8221; or &#8220;government&#8221; records from consumer privacy laws.</p>
<p>Those include voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, and bankruptcy filings. Data brokers also can enrich consumer records with additional information, by adding social media data and known associates.</p>
<p>The March 14 story on Onerep was the second in a series of three investigative reports published here this month that examined the data broker and people-search industries, and highlighted the need for more congressional oversight &#8212; if not regulation &#8212; on consumer data protection and privacy.</p>
<p>On March 8, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">A Close Up Look at the Consumer Data Broker Radaris</a>, which showed that the co-founders of Radaris operate multiple Russian-language dating services and affiliate programs. It also appears many of their businesses have ties to a California marketing firm that works with a Russian state-run media conglomerate currently sanctioned by the U.S. government.</p>
<p>On March 20, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/the-not-so-true-people-search-network-from-china/" target="_blank" rel="noopener">The Not-So-True People-Search Network from China</a>, which revealed an elaborate web of phony people-search companies and executives designed to conceal the location of people-search affiliates in China who are earning money promoting U.S. based data brokers that sell personal information on Americans.</p>


feed_id: https://krebsonsecurity.com/?p=66902
title: Recent ‘MFA Bombing’ Attacks Targeting Apple Users
uri: Recent-MFA-Bombing-Attacks-Targeting-Apple-Users
url: https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/
content:
<p>Several <strong>Apple</strong> customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple&#8217;s password reset feature. In this scenario, a target&#8217;s Apple devices are forced to display dozens of system-level prompts that prevent the devices from being used until the recipient responds &#8220;Allow&#8221; or &#8220;Don&#8217;t Allow&#8221; to each prompt. Assuming the user manages not to fat-finger the wrong button on the umpteenth password reset request, the scammers will then call the victim while spoofing Apple support in the caller ID, saying the user&#8217;s account is under attack and that Apple support needs to &#8220;verify&#8221; a one-time code.</p>
<div id="attachment_66915" style="width: 269px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66915" decoding="async" class=" wp-image-66915" src="media/b5b73aa8.patelpass.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/patelpass.png" alt="" width="259" height="559" /><p id="caption-attachment-66915" class="wp-caption-text">Some of the many notifications Patel says he received from Apple all at once.</p></div>
<p><strong>Parth Patel</strong> is an entrepreneur who is trying to build a startup in the conversational AI space. On March 23, Patel <a href="https://twitter.com/parth220_/status/1771589789143478471" target="_blank" rel="noopener">documented on Twitter/X</a> a recent phishing campaign targeting him that involved what&#8217;s known as a &#8220;push bombing&#8221; or &#8220;<a href="https://www.beyondtrust.com/resources/glossary/mfa-fatigue-attack" target="_blank" rel="noopener">MFA fatigue</a>&#8221; attack, wherein the phishers abuse a feature or weakness of a multi-factor authentication (MFA) system in a way that inundates the target&#8217;s device(s) with alerts to approve a password change or login.</p>
<p>&#8220;All of my devices started blowing up, my watch, laptop and phone,&#8221; Patel told KrebsOnSecurity. &#8220;It was like this system notification from Apple to approve [a reset of the account password], but I couldn&#8217;t do anything else with my phone. I had to go through and decline like 100-plus notifications.&#8221;</p>
<p>Some people confronted with such a deluge may eventually click &#8220;Allow&#8221; to the incessant password reset prompts &#8212; just so they can use their phone again. Others may inadvertently approve one of these prompts, which will also appear on a user&#8217;s Apple watch if they have one.</p>
<p>But the attackers in this campaign had an ace up their sleeves: Patel said after denying all of the password reset prompts from Apple, he received a call on his iPhone that said it was from Apple Support (the number displayed was 1-800-275-2273, Apple&#8217;s real customer support line).</p>
<p>&#8220;I pick up the phone and I&#8217;m super suspicious,&#8221; Patel recalled. &#8220;So I ask them if they can verify some information about me, and after hearing some aggressive typing on his end he gives me all this information about me and it&#8217;s totally accurate.&#8221;</p>
<p>All of it, that is, except his real name. Patel said when he asked the fake Apple support rep to validate the name they had on file for the Apple account, the caller gave a name that was not his but rather one that Patel has only seen in background reports about him that are for sale at a people-search website called <strong>PeopleDataLabs</strong>.</p>
<p>Patel said he has worked fairly hard to remove his information from multiple <a href="https://krebsonsecurity.com/?s=people-search" target="_blank" rel="noopener">people-search websites</a>, and he found PeopleDataLabs uniquely and consistently listed this inaccurate name as an alias on his consumer profile.</p>
<p>&#8220;For some reason, PeopleDataLabs has three profiles that come up when you search for my info, and two of them are mine but one is an elementary school teacher from the midwest,&#8221; Patel said. &#8220;I asked them to verify my name and they said Anthony.&#8221;</p>
<p>Patel said the goal of the voice phishers is to trigger an Apple ID reset code to be sent to the user&#8217;s device, which is a text message that includes a one-time password. If the user supplies that one-time code, the attackers can then reset the password on the account and lock the user out. They can also then <a href="https://support.apple.com/guide/icloud/erase-a-device-mmfc0ef36f/icloud#:~:text=Remotely%20erase%20your%20device%20or,Follow%20the%20onscreen%20instructions." target="_blank" rel="noopener">remotely wipe</a> all of the user&#8217;s Apple devices.</p>
<h2>THE PHONE NUMBER IS KEY</h2>
<p>Chris is a cryptocurrency hedge fund owner who asked that only his first name be used so as not to paint a bigger target on himself. Chris told KrebsOnSecurity he experienced a remarkably similar phishing attempt in late February.</p>
<p>&#8220;The first alert I got I hit &#8216;Don&#8217;t Allow&#8217;, but then right after that I got like 30 more notifications in a row,&#8221; Chris said. &#8220;I figured maybe I sat on my phone weird, or was accidentally pushing some button that was causing these, and so I just denied them all.&#8221;</p>
<p>Chris says the attackers persisted hitting his devices with the reset notifications for several days after that, and at one point he received a call on his iPhone that said it was from Apple support.</p>
<p>&#8220;I said I would call them back and hung up,&#8221; Chris said, demonstrating <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">the proper response to such unbidden solicitations</a>. &#8220;When I called back to the real Apple, they couldn&#8217;t say whether anyone had been in a support call with me just then. They just said Apple states very clearly that it will never initiate outbound calls to customers &#8212; unless the customer requests to be contacted.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="749" height="472" /></p>
<p>Massively freaking out that someone was trying to hijack his digital life, Chris said he changed his passwords and then went to an Apple store and bought a new iPhone. From there, he created a new Apple iCloud account using a brand new email address.</p>
<p>Chris said he then proceeded to get even more system alerts on his new iPhone and iCloud account &#8212; <em>all the while still sitting at the local Apple Genius Bar</em>.</p>
<p>Chris told KrebsOnSecurity his Genius Bar tech was mystified about the source of the alerts, but Chris said he suspects that whatever the phishers are abusing to rapidly generate these Apple system alerts requires knowing the phone number on file for the target&#8217;s Apple account. After all, that was the <em>only</em> aspect of Chris&#8217;s new iPhone and iCloud account that hadn&#8217;t changed.<span id="more-66902"></span></p>
<h2>WATCH OUT!</h2>
<p>&#8220;Ken&#8221; is a security industry veteran who spoke on condition of anonymity. Ken said he first began receiving these unsolicited system alerts on his Apple devices earlier this year, but that he has not received any phony Apple support calls as others have reported.</p>
<p>&#8220;This recently happened to me in the middle of the night at 12:30 a.m.,&#8221; Ken said. &#8220;And even though I have my Apple watch set to remain quiet during the time I&#8217;m usually sleeping at night, it woke me up with one of these alerts. Thank god I didn&#8217;t press &#8216;Allow,&#8217; which was the first option shown on my watch. I had to scroll watch the wheel to see and press the &#8216;Don&#8217;t Allow&#8217; button.&#8221;</p>
<div id="attachment_66911" style="width: 545px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66911" decoding="async" loading="lazy" class=" wp-image-66911" src="media/552a36b0.resetpassword.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/resetpassword.png" alt="" width="535" height="502" /><p id="caption-attachment-66911" class="wp-caption-text">Ken shared this photo he took of an alert on his watch that woke him up at 12:30 a.m. Ken said he had to scroll on the watch face to see the &#8220;Don&#8217;t Allow&#8221; button.</p></div>
<p>Unnerved by the idea that he could have rolled over on his watch while sleeping and allowed criminals to take over his Apple account, Ken said he contacted the real Apple support and was eventually escalated to a senior Apple engineer. The engineer assured Ken that turning on an <a href="https://support.apple.com/en-us/109345" target="_blank" rel="noopener">Apple Recovery Key</a> for his account would stop the notifications once and for all.</p>
<p>A recovery key is an optional security feature that Apple says &#8220;helps improve the security of your Apple ID account.&#8221; It is a randomly generated 28-character code, and when you enable a recovery key it is supposed to disable Apple&#8217;s standard account recovery process. The thing is, enabling it is not a simple process, and if you ever lose that code in addition to all of your Apple devices you will be permanently locked out.</p>
<p>Ken said he enabled a recovery key for his account as instructed, but that it hasn&#8217;t stopped the unbidden system alerts from appearing on all of his devices every few days.</p>
<p>KrebsOnSecurity tested Ken&#8217;s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices. Visiting Apple&#8217;s &#8220;forgot password&#8221; page &#8212; https://iforgot.apple.com &#8212; asks for an email address and for the visitor to solve a CAPTCHA.</p>
<p>After that, the page will display the last two digits of the phone number tied to the Apple account. Filling in the missing digits and hitting submit on that form will send a system alert, whether or not the user has enabled an Apple Recovery Key.</p>
<div id="attachment_66922" style="width: 690px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66922" decoding="async" loading="lazy" class="size-full wp-image-66922" src="media/c759b25b.applereset.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/applereset.png" alt="" width="680" height="552" /><p id="caption-attachment-66922" class="wp-caption-text">The password reset page at iforgot.apple.com.</p></div>
<h2>RATE LIMITS</h2>
<p>What sanely designed authentication system would send dozens of requests for a password change in the span of a few moments, when the first requests haven&#8217;t even been acted on by the user? Could this be the result of a bug in Apple&#8217;s systems?</p>
<p>Apple has not yet responded to requests for comment.</p>
<p>Throughout 2022, a criminal hacking group known as <a href="https://krebsonsecurity.com/?s=lapsus%24" target="_blank" rel="noopener">LAPSUS$</a> used MFA bombing <a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-enforces-number-matching-to-fight-mfa-fatigue-attacks/" target="_blank" rel="noopener">to great effect</a> in intrusions at <strong>Cisco</strong>, <strong>Microsoft</strong> and <strong>Uber</strong>. In response, Microsoft began enforcing &#8220;<a href="https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match" target="_blank" rel="noopener">MFA number matching</a>,&#8221; a feature that displays a series of numbers to a user attempting to log in with their credentials. These numbers must then be entered into the account owner&#8217;s Microsoft authenticator app on their mobile device to verify they are logging into the account.</p>
<p><strong>Kishan Bagaria</strong> is a hobbyist security researcher and engineer who founded the website texts.com (now owned by <a href="https://www.automattic.com/" target="_blank" rel="noopener">Automattic</a>), and he&#8217;s convinced Apple has a problem on its end. In August 2019, Bagaria reported to Apple a bug that allowed an exploit he dubbed &#8220;<a href="https://kishan.org/airdos/" target="_blank" rel="noopener">AirDoS</a>&#8221; because it could be used to let an attacker infinitely spam all nearby iOS devices with a system-level prompt to share a file via AirDrop &#8212; a file-sharing capability built into Apple products.</p>
<p>Apple fixed that bug nearly four months later in December 2019, thanking Bagaria in <a href="https://support.apple.com/en-us/HT210785" target="_blank" rel="noopener">the associated security bulletin</a>. Bagaria said Apple&#8217;s fix was to add stricter rate limiting on AirDrop requests, and he suspects that someone has figured out a way to bypass Apple&#8217;s rate limit on how many of these password reset requests can be sent in a given timeframe.</p>
<p>&#8220;I think this could be a legit Apple rate limit bug that should be reported,&#8221; Bagaria said.</p>


feed_id: https://krebsonsecurity.com/?p=66425
title: Thread Hijacking: Phishes That Prey on Your Curiosity
uri: Thread-Hijacking-Phishes-That-Prey-on-Your-Curiosity
url: https://krebsonsecurity.com/2024/03/thread-hijacking-phishes-that-prey-on-your-curiosity/
content:
<p>Thread hijacking attacks. They happen when someone you know has their email account compromised, and you are suddenly dropped into an existing conversation between the sender and someone else. These missives draw on the recipient&#8217;s natural curiosity about being copied on a private discussion, which is modified to include a malicious link or attachment. Here&#8217;s the story of a recent thread hijacking attack in which a journalist was copied on a phishing email from the unwilling subject of a recent scoop.</p>
<p>In Sept. 2023, the Pennsylvania news outlet <strong>LancasterOnline.com</strong> published <a href="https://lancasteronline.com/news/politics/smucker-the-ex-con-relationship-includes-travel-nearly-250-000-in-campaign-cash-and-donations/article_96710ba8-595a-11ee-a9e2-a762f8f372bd.html" target="_blank" rel="noopener">a story</a> about <strong>Adam Kidan</strong>, a wealthy businessman with a criminal past who is a major donor to Republican causes and candidates, including <strong>Rep. Lloyd Smucker</strong> (R-Pa).</p>
<div id="attachment_66969" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66969" decoding="async" class=" wp-image-66969" src="media/f9b5160e.kidanstory.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory.png" alt="" width="750" height="473" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory.png 1070w, https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory-768x484.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory-782x493.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66969" class="wp-caption-text">The LancasterOnline story about Adam Kidan.</p></div>
<p>Several months after that piece ran, the story&#8217;s author <strong>Brett Sholtis</strong> received two emails from Kidan, both of which contained attachments. One of the messages appeared to be a lengthy conversation between Kidan and a colleague, with the subject line, &#8220;Re: Successfully sent data.&#8221; The second missive was a more brief email from Kidan with the subject, &#8220;Acknowledge New Work Order,&#8221; and a message that read simply, &#8220;Please find the attached.&#8221;</p>
<p>Sholtis said he clicked the attachment in one of the messages, which then launched a web page that looked exactly like a Microsoft Office 365 login page. An analysis of the webpage reveals it would check any submitted credentials at the real Microsoft website, and return an error if the user entered bogus account information. A successful login would record the submitted credentials and forward the victim to the real Microsoft website.</p>
<p>But Sholtis said he didn&#8217;t enter his Outlook username and password. Instead, he forwarded the messages to LancasterOneline&#8217;s IT team, which quickly flagged them as phishing attempts.</p>
<p>LancasterOnline&#8217;s <strong>Executive Editor Tom Murse</strong> said the two phishing messages from Mr. Kidan raised eyebrows in the newsroom because Kidan had threatened to sue the news outlet multiple times over Sholtis&#8217;s story.</p>
<p>&#8220;We were just perplexed,&#8221; Murse said. &#8220;It seemed to be a phishing attempt but we were confused why it would come from a prominent businessman we&#8217;ve written about. Our initial response was confusion, but we didn&#8217;t know what else to do with it other than to send it to the FBI.&#8221;<span id="more-66425"></span></p>
<div id="attachment_66970" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66970" decoding="async" loading="lazy" class=" wp-image-66970" src="media/3610c321.empireworkforce.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/empireworkforce.png" alt="" width="748" height="501" /><p id="caption-attachment-66970" class="wp-caption-text">The phishing lure attached to the thread hijacking email from Mr. Kidan.</p></div>
<p>In 2006, Kidan was sentenced to 70 months in federal prison after pleading guilty to defrauding lenders along with <a href="https://en.wikipedia.org/wiki/Jack_Abramoff" target="_blank" rel="noopener">Jack Abramoff</a>, the disgraced lobbyist whose corruption <a href="https://www.nytimes.com/2020/06/25/us/politics/jack-abramoff-marijuana-cryptocurrency.html" target="_blank" rel="noopener">became a symbol</a> of the excesses of Washington influence peddling. He was paroled in 2009, and in 2014 moved his family to a home in Lancaster County, Pa.</p>
<p>The FBI hasn&#8217;t responded to LancasterOnline&#8217;s tip. Messages sent by KrebsOnSecurity to Kidan&#8217;s emails addresses were returned as blocked. Messages left with Mr. Kidan&#8217;s company, Empire Workforce Solutions, went unreturned.</p>
<p>No doubt the FBI saw the messages from Kidan for what they likely were: The result of Mr. Kidan having his Microsoft Outlook account compromised and used to send malicious email to people in his contacts list.</p>
<p>Thread hijacking attacks are hardly new, but that is mainly true because many Internet users still don&#8217;t know how to identify them. The email security firm <strong>Proofpoint</strong> says it has tracked north of 90 million malicious messages in the last five years that leverage this attack method.</p>
<p>One key reason thread hijacking is so successful is that these attacks generally do not include the tell that exposes most phishing scams: A fabricated sense of urgency. A majority of phishing threats warn of negative consequences should you fail to act quickly &#8212; such as an account suspension or an unauthorized high-dollar charge going through.</p>
<p>In contrast, thread hijacking campaigns tend to patiently prey on the natural curiosity of the recipient.</p>
<p><strong>Ryan Kalember</strong>, chief strategy officer at Proofpoint, said probably the most ubiquitous examples of thread hijacking are &#8220;CEO fraud&#8221; or &#8220;<a href="https://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/#:~:text=On%20the%20surface%2C%20business%20email%20compromise%20scams%20may%20seem%20unsophisticated%20relative%20to%20moneymaking%20schemes%20that%20involve%20complex%20malicious%20software%2C%20such%20as%20Dyre%20and%20ZeuS." target="_blank" rel="noopener">business email compromise</a>&#8221; scams, wherein employees are tricked by an email from a senior executive into wiring millions of dollars to fraudsters overseas.</p>
<p>But Kalember said these low-tech attacks can nevertheless be quite effective because they tend to catch people off-guard.</p>
<p>&#8220;It works because you feel like you&#8217;re suddenly included in an important conversation,&#8221; Kalember said. &#8220;It just registers a lot differently when people start reading, because you think you&#8217;re observing a private conversation between two different people.&#8221;</p>
<p>Some thread hijacking attacks actually involve multiple threat actors who are actively conversing while copying &#8212; but not addressing &#8212; the recipient.</p>
<p>&#8220;We call these mutli-persona phishing scams, and they&#8217;re often paired with thread hijacking,&#8221; Kalember said. &#8220;It&#8217;s basically a way to build a little more affinity than just copying people on an email. And the longer the conversation goes on, the higher their success rate seems to be because some people start replying to the thread [and participating] psycho-socially.&#8221;</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links or attachments that arrive unbidden in emails, text messages and other mediums. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=66576
title: ‘The Manipulaters’ Improve Phishing, Still Fail at Opsec
uri: The-Manipulaters-Improve-Phishing-Still-Fail-at-Opsec
url: https://krebsonsecurity.com/2024/04/the-manipulaters-improve-phishing-still-fail-at-opsec/
content:
<p>Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called &#8220;<strong>The Manipulaters</strong>,&#8221; a sprawling web hosting network of phishing and spam delivery platforms. In January 2024, The Manipulaters pleaded with this author to unpublish previous stories about their work, claiming the group had turned over a new leaf and gone legitimate. But new research suggests that while they have improved the quality of their products and services, these nitwits still fail spectacularly at hiding their illegal activities.</p>
<p>In May 2015, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2015/05/phishing-gang-is-audacious-manipulator/" target="_blank" rel="noopener">a brief writeup</a> about the brazen Manipulaters team, noting that they openly operated hundreds of web sites selling tools designed to trick people into giving up usernames and passwords, or deploying malicious software on their PCs.</p>
<div id="attachment_67010" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67010" decoding="async" class=" wp-image-67010" src="media/e2748fd6.manipulaters-o365.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365.png" alt="" width="750" height="292" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365.png 1097w, https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365-768x299.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365-782x304.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67010" class="wp-caption-text">Manipulaters advertisement for &#8220;Office 365 Private Page with Antibot&#8221; phishing kit sold on the domain heartsender,com. &#8220;Antibot&#8221; refers to functionality that attempts to evade automated detection techniques, keeping a phish deployed as long as possible. Image: DomainTools.</p></div>
<p>The core brand of The Manipulaters has long been a shared cybercriminal identity named &#8220;<strong>Saim Raza</strong>,&#8221; who for the past decade has peddled a popular spamming and phishing service variously called &#8220;<strong>Fudtools</strong>,&#8221; &#8220;<strong>Fudpage</strong>,&#8221; &#8220;<strong>Fudsender</strong>,&#8221; &#8220;<strong>FudCo</strong>,&#8221; etc. The term &#8220;FUD&#8221; in those names stands for “<strong>F</strong>ully <strong>U</strong>n-<strong>D</strong>etectable,” and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances.</p>
<p>A <a href="https://krebsonsecurity.com/2021/09/fudco-spam-empire-tied-to-pakistani-software-firm/" target="_blank" rel="noopener">September 2021 story here</a> checked in on The Manipulaters, and found that Saim Raza and company were prospering under their FudCo brands, which they secretly managed from a front company called <strong>We Code Solutions</strong>.</p>
<p>That piece worked backwards from all of the known Saim Raza email addresses to identify Facebook profiles for multiple We Code Solutions employees, many of whom could be seen celebrating company anniversaries gathered around a giant cake with the words &#8220;FudCo&#8221; painted in icing.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-56860" src="media/8a798345.fudcocake.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png" alt="" width="750" height="772" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png 834w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-768x790.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-782x805.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Since that story ran, KrebsOnSecurity has heard from this Saim Raza identity on two occasions. The first was in the weeks following the Sept. 2021 piece, when one of Saim Raza&#8217;s known email addresses &#8212; <strong>bluebtcus@gmail.com</strong> &#8212; pleaded to have the story taken down.</p>
<p>&#8220;Hello, we already leave that fud etc before year,&#8221; the Saim Raza identity wrote. &#8220;Why you post us? Why you destroy our lifes? We never harm anyone. Please remove it.&#8221;</p>
<p>Not wishing to be manipulated by a phishing gang, KrebsOnSecurity ignored those entreaties. But on Jan. 14, 2024, KrebsOnSecurity heard from the same bluebtcus@gmail.com address, apropos of nothing.</p>
<p>&#8220;Please remove this article,&#8221; Sam Raza wrote, linking to the 2021 profile. <span class="pullquote pqright">&#8220;Please already my police register case on me. I already leave everything.&#8221;</span></p>
<p>Asked to elaborate on the police investigation, Saim Raza said they were freshly released from jail.</p>
<p>&#8220;I was there many days,&#8221; the reply explained. &#8220;Now back after bail. Now I want to start my new work.&#8221;</p>
<p>Exactly what that &#8220;new work&#8221; might entail, Saim Raza wouldn&#8217;t say. But <a href="https://www.domaintools.com/resources/blog/the-resurgence-of-the-manipulaters-team-breaking-heartsenders?utm_source=Krebs-on-Security" target="_blank" rel="noopener">a new report</a> from researchers at <strong>DomainTools.com</strong> finds that several computers associated with The Manipulaters have been massively hacked by malicious data- and password-snarfing malware for quite some time.</p>
<p>DomainTools says the malware infections on Manipulaters PCs exposed &#8220;vast swaths of account-related data along with an outline of the group&#8217;s membership, operations, and position in the broader underground economy.&#8221;</p>
<p>&#8220;Curiously, the large subset of identified Manipulaters customers appear to be compromised by the same stealer malware,&#8221; DomainTools wrote. &#8220;All observed customer malware infections began after the initial compromise of Manipulaters PCs, which raises a number of questions regarding the origin of those infections.&#8221;<span id="more-66576"></span></p>
<p>A number of questions, indeed. The core Manipulaters product these days is a spam delivery service called <strong>HeartSender</strong>, whose homepage openly advertises phishing kits targeting users of various Internet companies, including <strong>Microsoft 365</strong>, <strong>Yahoo</strong>, <strong>AOL</strong>, <strong>Intuit</strong>, <strong>iCloud</strong> and <strong>ID.me</strong>, to name a few.</p>
<div id="attachment_67009" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67009" decoding="async" loading="lazy" class=" wp-image-67009" src="media/cbdabd4b.heartsender.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender.png" alt="" width="750" height="442" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender.png 1147w, https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender-768x453.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender-782x461.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67009" class="wp-caption-text">A screenshot of the homepage of HeartSender 4 displays an IP address tied to fudtoolshop@gmail.com. Image: DomainTools.</p></div>
<p>HeartSender customers can interact with the subscription service via the website, but the product appears to be far more effective and user-friendly if one downloads HeartSender as a Windows executable program. Whether that HeartSender program was somehow compromised and used to infect the service&#8217;s customers is unknown.</p>
<p>However, DomainTools also found the hosted version of HeartSender service leaks an extraordinary amount of user information that probably is not intended to be publicly accessible. Apparently, the HeartSender web interface has several webpages that are accessible to unauthenticated users, exposing customer credentials along with support requests to HeartSender developers.</p>
<p>&#8220;Ironically, the Manipulaters may create more short-term risk to their own customers than law enforcement,&#8221; DomainTools wrote. &#8220;The data table “User Feedbacks” (sic) exposes what appear to be customer authentication tokens, user identifiers, and even a customer support request that exposes root-level SMTP credentials–all visible by an unauthenticated user on a Manipulaters-controlled domain. Given the risk for abuse, this domain will not be published.&#8221;</p>
<p>This is hardly the first time The Manipulaters have shot themselves in the foot. In 2019, <em>The Manipulaters failed to renew their core domain name</em> — manipulaters[.]com — the same one tied to so many of the company’s past and current business operations. That domain was quickly scooped up by <a href="https://www.scyllaintel.com/" target="_blank" rel="noopener">Scylla Intel</a>, a cyber intelligence firm that focuses on connecting cybercriminals to their real-life identities.</p>
<p>Currently, The Manipulaters seem focused on building out and supporting HeartSender, which specializes in spam and email-to-SMS spamming services.</p>
<p>&#8220;The Manipulaters’ newfound interest in email-to-SMS spam could be in response to the massive increase in <a href="https://krebsonsecurity.com/2023/10/phishers-spoof-usps-12-other-natl-postal-services/" target="_blank" rel="noopener">smishing activity impersonating the USPS</a>,&#8221; DomainTools wrote. &#8220;Proofs posted on HeartSender’s Telegram channel contain numerous references to postal service impersonation, including proving delivery of USPS-themed phishing lures and the sale of a USPS phishing kit.&#8221;</p>
<p>Reached via email, the Saim Raza identity declined to respond to questions about the DomainTools findings.</p>
<p>&#8220;First [of] all we never work on virus or compromised computer etc,&#8221; Raza replied. &#8220;If you want to write like that fake go ahead. Second I leave country already. If someone bind anything with exe file and spread on internet its not my fault.&#8221;</p>
<p>Asked why they left Pakistan, Saim Raza said the authorities there just wanted to shake them down.</p>
<p>&#8220;After your article our police put FIR on my [identity],&#8221; Saim Raza explained. &#8220;FIR&#8221; in this case stands for &#8220;First Information Report,&#8221; which is the initial complaint in the criminal justice system of Pakistan.</p>
<p>&#8220;They only get money from me nothing else,&#8221; Saim Raza continued. &#8220;Now some officers ask for money again again. Brother, there is no good law in Pakistan just they need money.&#8221;</p>
<p>Saim Raza has a history of being slippery with the truth, so who knows whether The Manipulaters and/or its leaders have in fact fled Pakistan (it may be more of an extended vacation abroad). With any luck, these guys will soon venture into a more Western-friendly, &#8220;good law&#8221; nation and receive a warm welcome by the local authorities.</p>


feed_id: https://krebsonsecurity.com/?p=67035
title: Fake Lawsuit Threat Exposes Privnote Phishing Sites
uri: Fake-Lawsuit-Threat-Exposes-Privnote-Phishing-Sites
url: https://krebsonsecurity.com/2024/04/fake-lawsuit-threat-exposes-privnote-phishing-sites/
content:
<p>A cybercrook who has been setting up websites that mimic the self-destructing message service <strong>privnote.com</strong> accidentally exposed the breadth of their operations recently when they threatened to sue a software company. The disclosure revealed a profitable network of phishing sites that behave and look like the real Privnote, except that any messages containing cryptocurrency addresses will be automatically altered to include a different payment address controlled by the scammers.</p>
<div id="attachment_67081" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67081" decoding="async" class=" wp-image-67081" src="media/214dd656.privnotedotcom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/privnotedotcom.png" alt="" width="748" height="746" /><p id="caption-attachment-67081" class="wp-caption-text">The real Privnote, at privnote.com.</p></div>
<p>Launched in 2008, privnote.com employs technology that encrypts each message so that even Privnote itself <a href="https://privnote.com/info/privacy" target="_blank" rel="noopener noreferrer">cannot read its contents</a>. And it doesn’t send or receive messages. Creating a message merely generates a link. When that link is clicked or visited, the service warns that the message will be gone forever after it is read.</p>
<p>Privnote&#8217;s ease-of-use and popularity among cryptocurrency enthusiasts has made it <a href="https://krebsonsecurity.com/2020/06/privnotes-com-is-phishing-bitcoin-from-users-of-private-messaging-service-privnote-com/" target="_blank" rel="noopener">a perennial target of phishers</a>, who erect Privnote clones that function more or less as advertised but also quietly inject their own cryptocurrency payment addresses when a note is created that contains crypto wallets.</p>
<p>Last month, a new user on <strong>GitHub</strong> named <strong>fory66399</strong> <a href="https://github.com/MetaMask/eth-phishing-detect/issues/29814" target="_blank" rel="noopener">lodged a complaint</a> on the &#8220;issues&#8221; page for <strong>MetaMask</strong>, a software cryptocurrency wallet used to interact with the Ethereum blockchain. Fory66399 insisted that their website &#8212; <strong>privnote[.]co</strong> &#8212; was being wrongly flagged by MetaMask&#8217;s &#8220;eth-phishing-detect&#8221; list as malicious.</p>
<p>&#8220;We filed a lawsuit with a lawyer for dishonestly adding a site to the block list, damaging reputation, as well as ignoring the moderation department and ignoring answers!&#8221; fory66399 threatened. &#8220;Provide evidence or I will demand compensation!&#8221;</p>
<p>MetaMask&#8217;s lead product manager <strong>Taylor Monahan</strong> replied by posting several screenshots of privnote[.]co showing the site did indeed swap out any cryptocurrency addresses.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67040" src="media/5f5d3178.tayprivnoteco.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco.png" alt="" width="750" height="774" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco.png 858w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco-768x792.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco-782x807.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>After being told where they could send a copy of their lawsuit, Fory66399 appeared to become flustered, and proceeded to mention a number of other interesting domain names:</p>
<blockquote><p>You sent me screenshots from some other site! It&#8217;s red!!!!<br />
The tornote.io website has a different color altogether<br />
The privatenote,io website also has a different color! What&#8217;s wrong?????</p></blockquote>
<p>A search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> for privatenote[.]io shows it has been registered to two names over as many years, including <strong>Andrey Sokol</strong> from Moscow and <strong>Alexandr Ermakov</strong> from Kiev. There is no indication these are the real names of the phishers, but the names are useful in pointing to other sites targeting Privnote since 2020.</p>
<p>DomainTools says other domains registered to Alexandr Ermakov include <strong>pirvnota[.]com</strong>, <strong>privatemessage[.]net</strong>, <strong>privatenote[.]io</strong>, and <strong>tornote[.]io</strong>.</p>
<div id="attachment_67046" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67046" decoding="async" loading="lazy" class="wp-image-67046" src="media/f2082d18.privatemessage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage.png" alt="" width="747" height="461" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage.png 1104w, https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage-768x474.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage-782x482.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-67046" class="wp-caption-text">A screenshot of the phishing domain privatemessage dot net.</p></div>
<p>The registration records for pirvnota[.]com at one point were updated from Andrey Sokol to &#8220;<strong>BPW</strong>&#8221; as the registrant organization, and &#8220;<strong>Tambov district</strong>&#8221; in the registrant state/province field. Searching DomainTools for domains that include both of these terms reveals <strong>pirwnote[.]com</strong>.</p>
<p>Other Privnote phishing domains that also phoned home to the same Internet address as pirwnote[.]com include <strong>privnode[.]com</strong>, <strong>privnate[.]com</strong>, and <strong>prevnóte[.]com</strong>. Pirwnote[.]com is currently selling security cameras made by the Chinese manufacturer <a href="https://krebsonsecurity.com/tag/hikvision/" target="_blank" rel="noopener">Hikvision</a>, via an Internet address based in Hong Kong.</p>
<p>It appears someone has gone to great lengths to make tornote[.]io seem like a legitimate website. For example, <a href="https://medium.com/@tornoteprivnote" target="_blank" rel="noopener">this account at Medium</a> has authored more than a dozen blog posts in the past year singing the praises of Tornote as a secure, self-destructing messaging service. However, <a href="media/349bfe31.tornote-before.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-before.png" target="_blank" rel="noopener">testing</a> <a href="media/7aeb7310.tornote-after.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after.png" target="_blank" rel="noopener">shows</a> tornote[.]io will also replace any cryptocurrency addresses in messages with their own payment address.<span id="more-67035"></span></p>
<p>These malicious note sites attract visitors by gaming search engine results to make the phishing domains appear prominently in search results for &#8220;privnote.&#8221; A search in Google for &#8220;privnote&#8221; currently returns tornote[.]io as the fifth result. Like other phishing sites tied to this network, Tornote will use the same cryptocurrency addresses for roughly 5 days, and then rotate in new payment addresses.</p>
<div id="attachment_67044" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67044" decoding="async" loading="lazy" class="wp-image-67044" src="media/7aeb7310.tornote-after.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after.png" alt="" width="748" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after.png 1280w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after-768x469.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after-782x478.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-67044" class="wp-caption-text">Tornote changed the cryptocurrency address entered into a test note to this address controlled by the phishers.</p></div>
<p>Throughout 2023, Tornote was hosted with the Russian provider <a href="https://krebsonsecurity.com/tag/ddos-guard/" target="_blank" rel="noopener">DDoS-Guard</a>, at the Internet address <strong>186.2.163[.]216</strong>. A review of the passive DNS records tied to this address shows that apart from subdomains dedicated to tornote[.]io, the main other domain at this address was <strong>hkleaks[.]ml</strong>.</p>
<p>In August 2019, a slew of websites and social media channels dubbed &#8220;HKLEAKS&#8221; began doxing the identities and personal information of pro-democracy activists in Hong Kong. According to <a href="media/dccbbd2d.Report23168--hkleaks-061323.pdf" data-original-source="https://tspace.library.utoronto.ca/bitstream/1807/128586/1/Report%23168--hkleaks-061323.pdf" target="_blank" rel="noopener">a report</a> (PDF) from <strong>Citizen Lab</strong>, hkleaks[.]ml was the second domain that appeared as the perpetrators began to expand the list of those doxed.</p>
<div id="attachment_67042" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67042" decoding="async" loading="lazy" class="wp-image-67042" src="media/3f00825a.hkleaks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks.png" alt="" width="748" height="257" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks.png 1373w, https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks-768x264.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks-782x269.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-67042" class="wp-caption-text">HKleaks, as indexed by The Wayback Machine.</p></div>
<p>DomainTools shows there are more than 1,000 other domains whose registration records include the organization name &#8220;BPW&#8221; and &#8220;Tambov District&#8221; as the location. Virtually all of those domains were registered through one of two registrars &#8212; Hong Kong-based <strong>Nicenic</strong> and Singapore-based <strong>WebCC </strong>&#8212; and almost all appear to be phishing or pill-spam related.</p>
<p>Among those is <strong>rustraitor[.]info</strong>, a website erected after Russia invaded Ukraine in early 2022 that doxed Russians perceived to have helped the Ukrainian cause.</p>
<div id="attachment_67043" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67043" decoding="async" loading="lazy" class="wp-image-67043" src="media/0c1b71bc.rustraitor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor.png" alt="" width="750" height="351" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor.png 1456w, https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor-768x359.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor-782x366.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67043" class="wp-caption-text">An archive.org copy of Rustraitor.</p></div>
<p>In keeping with the overall theme, these phishing domains appear focused on stealing usernames and passwords to some of the cybercrime underground&#8217;s busiest shops, including <a href="https://krebsonsecurity.com/?s=briansclub" target="_blank" rel="noopener">Brian&#8217;s Club</a>. What do all the phished sites have in common? They all accept payment via virtual currencies.</p>
<p>It appears MetaMask&#8217;s Monahan made the correct decision in forcing these phishers to tip their hand: Among the websites at that DDoS-Guard address are multiple MetaMask phishing domains, including <strong>metarrnask[.]com</strong>,<strong> meternask[.]com</strong>, and <strong>rnetamask[.]com</strong>.</p>
<p>How profitable are these private note phishing sites? Reviewing the four malicious cryptocurrency payment addresses that the attackers swapped into notes passed through privnote[.]co (as pictured in Monahan&#8217;s screenshot above) shows that between March 15 and March 19, 2024, those address raked in and transferred out nearly $18,000 in cryptocurrencies. And that&#8217;s just one of their phishing websites.</p>


feed_id: https://krebsonsecurity.com/?p=67114
title: April’s Patch Tuesday Brings Record Number of Fixes
uri: April-s-Patch-Tuesday-Brings-Record-Number-of-Fixes
url: https://krebsonsecurity.com/2024/04/aprils-patch-tuesday-brings-record-number-of-fixes/
content:
<p>If only Patch Tuesdays came around infrequently &#8212; like total solar eclipse rare &#8212; instead of just creeping up on us each month like The Man in the Moon. Although to be fair, it would be tough for <strong>Microsoft</strong> to eclipse the number of vulnerabilities fixed in this month&#8217;s patch batch &#8212; a record 147 flaws in <strong>Windows</strong> and related software.</p>
<p><img decoding="async" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="750" height="528" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Yes, you read that right. Microsoft today released updates to address 147 security holes in Windows, <strong>Office</strong>, <strong>Azure</strong>, <strong>.NET Framework</strong>, <strong>Visual Studio</strong>, <strong>SQL Server</strong>,<strong> DNS Server</strong>, <strong>Windows Defender</strong>, <strong>Bitlocker</strong>, and <strong>Windows Secure Boot</strong>.</p>
<p>&#8220;This is the largest release from Microsoft this year and the largest since at least 2017,&#8221; said <strong>Dustin Childs</strong>, from <strong>Trend Micro&#8217;s Zero Day Initiative </strong>(ZDI). &#8220;As far as I can tell, it’s the largest Patch Tuesday release from Microsoft of all time.&#8221;</p>
<p>Once again this month, there are no known zero-day vulnerabilities threatening Windows users. Tempering the sheer volume of this month&#8217;s patches is the middling severity of many of the bugs. Only three of April&#8217;s vulnerabilities earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning they can be abused by malware or malcontents to take remote control over unpatched systems with no help from users.</p>
<p>Most of the flaws that Microsoft deems &#8220;more likely to be exploited&#8221; this month are marked as &#8220;important,&#8221; which usually involve bugs that require a bit more user interaction (social engineering) but which nevertheless can result in system security bypass, compromise, and the theft of critical assets.</p>
<p><strong>Ben McCarthy</strong>, lead cyber security engineer at <strong>Immersive Labs</strong> called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-20670" target="_blank" rel="noopener">CVE-2024-20670</a>, an <strong>Outlook for Windows</strong> spoofing vulnerability described as being easy to exploit. It involves convincing a user to click on a malicious link in an email, which can then steal the user&#8217;s password hash and authenticate as the user in another Microsoft service.<span id="more-67114"></span></p>
<p>Another interesting bug McCarthy pointed to is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-29063" target="_blank" rel="noopener">CVE-2024-29063</a>, which involves hard-coded credentials in Azure&#8217;s search backend infrastructure that could be gleaned by taking advantage of <strong>Azure AI</strong> search.</p>
<p>&#8220;This along with many other AI attacks in recent news shows a potential new attack surface that we are just learning how to mitigate against,&#8221; McCarthy said. &#8220;Microsoft has updated their backend and notified any customers who have been affected by the credential leakage.&#8221;</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-29988" target="_blank" rel="noopener">CVE-2024-29988</a> is a weakness that allows attackers to bypass <strong>Windows SmartScreen</strong>, a technology Microsoft designed to provide additional protections for end users against phishing and malware attacks. Childs said one ZDI&#8217;s researchers found this vulnerability being exploited in the wild, although Microsoft doesn&#8217;t currently list CVE-2024-29988 as being exploited.</p>
<p>&#8220;I would treat this as in the wild until Microsoft clarifies,&#8221; Childs said. &#8220;The bug itself acts much like <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412" target="_blank" rel="noopener">CVE-2024-21412</a> – a [<a href="https://krebsonsecurity.com/2024/02/fat-patch-tuesday-february-2024-edition/" target="_blank" rel="noopener">zero-day threat from February</a>] that bypassed the Mark of the Web feature and allows malware to execute on a target system. Threat actors are sending exploits in a zipped file to evade EDR/NDR detection and then using this bug (and others) to bypass Mark of the Web.&#8221;</p>
<p><strong>Satnam Narang</strong> at <strong>Tenable</strong> notes that this month&#8217;s release includes fixes for two dozen flaws in <strong>Windows Secure Boot</strong>, the majority of which are considered “Exploitation Less Likely” according to Microsoft.</p>
<p>&#8220;However, the last time Microsoft patched a flaw in Windows Secure Boot <a href="https://krebsonsecurity.com/2023/05/microsoft-patch-tuesday-may-2023-edition/" target="_blank" rel="noopener">in May 2023</a> had a notable impact as it was exploited in the wild and linked to the BlackLotus UEFI bootkit, which was sold on dark web forums for $5,000,&#8221; Narang said. &#8220;BlackLotus can bypass functionality called secure boot, which is designed to block malware from being able to load when booting up. While none of these Secure Boot vulnerabilities addressed this month were exploited in the wild, they serve as a reminder that flaws in Secure Boot persist, and we could see more malicious activity related to Secure Boot in the future.&#8221;</p>
<p>For links to individual security advisories indexed by severity, check out <a href="https://www.zerodayinitiative.com/blog/2024/4/9/the-april-2024-security-updates-review" target="_blank" rel="noopener">ZDI&#8217;s blog</a> and the Patch Tuesday post from the <a href="https://isc.sans.edu/diary/April%202024%20Microsoft%20Patch%20Tuesday%20Summary/30822" target="_blank" rel="noopener">SANS Internet Storm Center</a>. Please consider backing up your data or your drive before updating, and drop a note in the comments here if you experience any issues applying these fixes.</p>
<p>Adobe today released nine patches tackling at least two dozen vulnerabilities in a range of software products, including <strong>Adobe After Effects</strong>, <strong>Photoshop</strong>, <strong>Commerce</strong>, <strong>InDesign</strong>, <strong>Experience Manager</strong>, <strong>Media Encoder</strong>, <strong>Bridge</strong>, <strong>Illustrator</strong>, and <strong>Adobe Animate</strong>.</p>
<p>KrebsOnSecurity needs to correct the record on a point mentioned at the end of March&#8217;s &#8220;<a href="https://krebsonsecurity.com/2024/02/fat-patch-tuesday-february-2024-edition/" target="_blank" rel="noopener">Fat Patch Tuesday</a>&#8221; post, which looked at new AI capabilities built into <strong>Adobe Acrobat</strong> that are turned on by default. Adobe has since clarified that its apps won&#8217;t use AI to auto-scan your documents, as the original language in its FAQ suggested.</p>
<p>&#8220;In practice, no document scanning or analysis occurs unless a user actively engages with the AI features by agreeing to the terms, opening a document, and selecting the AI Assistant or generative summary buttons for that specific document,&#8221; Adobe <a href="https://www.windowslatest.com/2024/04/02/adobe-clarifies-its-windows-apps-wont-auto-scan-your-documents-for-ai/" target="_blank" rel="noopener">said</a> earlier this month.</p>


feed_id: https://krebsonsecurity.com/?p=67137
title: Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers
uri: Twitter-s-Clumsy-Pivot-to-X-com-Is-a-Gift-to-Phishers
url: https://krebsonsecurity.com/2024/04/twitters-clumsy-pivot-to-x-com-is-a-gift-to-phishers/
content:
<p>On April 9, Twitter/X began automatically modifying links that mention &#8220;twitter.com&#8221; to read &#8220;x.com&#8221; instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links &#8212; such as <strong>fedetwitter[.]com</strong>, which until very recently rendered as <strong>fedex.com</strong> in tweets.</p>
<div id="attachment_67139" style="width: 662px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67139" decoding="async" class="wp-image-67139 size-full" src="media/c906679a.ruseriousx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/ruseriousx.png" alt="" width="652" height="698" /><p id="caption-attachment-67139" class="wp-caption-text">The message displayed when one visits goodrtwitter.com, which Twitter/X displayed as goodrx.com in tweets and messages.</p></div>
<p>A search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> shows at least 60 domain names have been registered over the past two days for domains ending in &#8220;twitter.com,&#8221; although research so far shows the majority of these domains have been registered &#8220;defensively&#8221; by private individuals to prevent the domains from being purchased by scammers.</p>
<p>Those include <strong>carfatwitter.com</strong>, which Twitter/X truncated to carfax.com when the domain appeared in user messages or tweets. Visiting this domain currently displays a message that begins, &#8220;Are you serious, X Corp?&#8221;</p>
<p><strong>Update:</strong> It appears Twitter/X has corrected its mistake, and no longer truncates any domain ending in &#8220;twitter.com&#8221; to &#8220;x.com.&#8221;</p>
<p><em>Original story:</em></p>
<p>The same message is on other newly registered domains, including <strong>goodrtwitter.com</strong> (goodrx.com), <strong>neobutwitter.com</strong> (neobux.com), <strong>roblotwitter.com</strong> (roblox.com), <strong>square-enitwitter.com</strong> (square-enix.com) and yandetwitter.com (yandex.com). The message left on these domains indicates they were defensively registered by <a href="https://compostintraining.club/@prplecake" target="_blank" rel="noopener">a user on Mastodon</a> whose bio says they are a systems admin/engineer. That profile has not responded to requests for comment.</p>
<p>A number of these new domains including &#8220;twitter.com&#8221; appear to be registered defensively by Twitter/X users in Japan. The domain netflitwitter.com (netflix.com, to Twitter/X users) now displays a message saying it was &#8220;acquired to prevent its use for malicious purposes,&#8221; along with a Twitter/X username.</p>
<p>The domain mentioned at the beginning of this story &#8212; fedetwitter.com &#8212; redirects users to the blog of a Japanese technology enthusiast. A user with the handle &#8220;amplest0e&#8221; appears to have registered <strong>space-twitter.com</strong>, which Twitter/X users would see as the CEO&#8217;s &#8220;space-x.com.&#8221; The domain &#8220;ametwitter.com&#8221; already redirects to the real americanexpress.com.<span id="more-67137"></span></p>
<p>Some of the domains registered recently and ending in &#8220;twitter.com&#8221; currently do not resolve and contain no useful contact information in their registration records. Those include <strong>firefotwitter[.]com</strong> (firefox.com), <strong>ngintwitter[.]com</strong> (nginx.com), and <strong>webetwitter[.]com</strong> (webex.com).</p>
<div id="attachment_67144" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67144" decoding="async" loading="lazy" class=" wp-image-67144" src="media/363c01b0.sextwitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter.png" alt="" width="750" height="491" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter.png 1299w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter-768x503.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter-782x512.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67144" class="wp-caption-text">The domain setwitter.com, which Twitter/X until very recently rendered as &#8220;sex.com,&#8221; redirects to this blog post warning about the recent changes and their potential use for phishing.</p></div>
<p><strong>Sean McNee</strong>, vice president of research and data at DomainTools, told KrebsOnSecurity it appears Twitter/X did not properly limit its redirection efforts.</p>
<p>&#8220;Bad actors could register domains as a way to divert traffic from legitimate sites or brands given the opportunity &#8212; many such brands in the top million domains end in x, such as webex, hbomax, xerox, xbox, and more,&#8221; McNee said. &#8220;It is also notable that several other globally popular brands, such as Rolex and Linux, were also on the list of registered domains.&#8221;</p>
<p>The apparent oversight by Twitter/X was cause for amusement and amazement from many former users who have migrated to other social media platforms since the new CEO took over. <strong>Matthew Garrett</strong>, a lecturer at U.C. Berkeley&#8217;s School of Information, <a href="https://infosec.exchange/@mjg59@nondeterministic.computer/112243298637438787" target="_blank" rel="noopener">summed up</a> the Schadenfreude thusly:</p>
<p>&#8220;Twitter just doing a &#8216;redirect links in tweets that go to x.com to twitter.com instead but accidentally do so for all domains that end x.com like eg spacex.com going to spacetwitter.com&#8217; is not absolutely the funniest thing I could imagine but it&#8217;s high up there.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67160
title: Why CISA is Warning CISOs About a Breach at Sisense
uri: Why-CISA-is-Warning-CISOs-About-a-Breach-at-Sisense
url: https://krebsonsecurity.com/2024/04/why-cisa-is-warning-cisos-about-a-breach-at-sisense/
content:
<p>The <strong>U.S. Cybersecurity and Infrastructure Security Agency</strong> (CISA) said today it is investigating a breach at business intelligence company <strong>Sisense</strong>, whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset any credentials and secrets that may have been shared with the company, which is the same advice Sisense gave to its customers Wednesday evening.</p>
<p><img decoding="async" class="aligncenter wp-image-67162" src="media/dc703211.sisense.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense.png" alt="" width="749" height="340" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense.png 1304w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense-768x348.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense-782x354.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>New York City based Sisense has more than a thousand customers across a range of industry verticals, including financial services, telecommunications, healthcare and higher education. On April 10, <strong>Sisense Chief Information Security Officer Sangram Dash</strong> told customers the company had been made aware of reports that &#8220;certain Sisense company information may have been made available on what we have been advised is a restricted access server (not generally available on the internet.)&#8221;</p>
<p>&#8220;We are taking this matter seriously and promptly commenced an investigation,&#8221; Dash continued. &#8220;We engaged industry-leading experts to assist us with the investigation. This matter has not resulted in an interruption to our business operations. Out of an abundance of caution, and while we continue to investigate, we urge you to promptly rotate any credentials that you use within your Sisense application.&#8221;</p>
<p>In its alert, CISA said it was working with private industry partners to respond to a recent compromise discovered by independent security researchers involving Sisense.</p>
<p>&#8220;CISA is taking an active role in collaborating with private industry partners to respond to this incident, especially as it relates to impacted critical infrastructure sector organizations,&#8221; the sparse alert reads. &#8220;We will provide updates as more information becomes available.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67161" src="media/759ceffc.cisa-sisense.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense.png" alt="" width="750" height="688" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense.png 884w, https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense-768x705.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense-782x717.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Sisense declined to comment when asked about the veracity of information shared by two trusted sources with close knowledge of the breach investigation. Those sources said the breach appears to have started when the attackers somehow gained access to the company&#8217;s Gitlab code repository, and in that repository was a token or credential that gave the bad guys access to Sisense&#8217;s Amazon S3 buckets in the cloud.</p>
<p>Customers can use Gitlab either as a solution that is hosted in the cloud at Gitlab.com, or as a self-managed deployment. KrebsOnSecurity understands that Sisense was using the self-managed version of Gitlab.</p>
<p>Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.</p>
<p>The incident raises questions about whether Sisense was doing enough to protect sensitive data entrusted to it by customers, such as whether the massive volume of stolen customer data was ever encrypted while at rest in these Amazon cloud servers.</p>
<p>It is clear, however, that unknown attackers now have all of the credentials that Sisense customers used in their dashboards.<span id="more-67160"></span></p>
<p>The breach also makes clear that Sisense is somewhat limited in the clean-up actions that it can take on behalf of customers, because access tokens are essentially text files on your computer that allow you to stay logged in for extended periods of time &#8212; sometimes indefinitely. And depending on which service we&#8217;re talking about, it may be possible for attackers to re-use those access tokens to authenticate as the victim without ever having to present valid credentials.</p>
<p>Beyond that, it is largely up to Sisense customers to decide if and when they change passwords to the various third-party services that they&#8217;ve previously entrusted to Sisense.</p>
<p>Earlier today, a public relations firm working with Sisense reached out to learn if KrebsOnSecurity planned to publish any further updates on their breach (KrebsOnSecurity posted a screenshot of the CISO&#8217;s customer email to both <a href="https://www.linkedin.com/posts/bkrebs_there-is-something-potentially-huge-popping-activity-7183982303784620033-T3wd?utm_source=share&amp;utm_medium=member_desktop" target="_blank" rel="noopener">LinkedIn</a> and <a href="https://infosec.exchange/@briankrebs/112249710611213991" target="_blank" rel="noopener">Mastodon</a> on Wednesday evening). The PR rep said Sisense wanted to make sure they had an opportunity to comment before the story ran.</p>
<p>But when confronted with the details shared by my sources, Sisense apparently changed its mind.</p>
<p>&#8220;After consulting with Sisense, they have told me that they don&#8217;t wish to respond,&#8221; the PR rep said in an emailed reply.</p>
<p><strong>Update, 6:49 p.m., ET:</strong> Added clarification that Sisense is using a self-hosted version of Gitlab, not the cloud version managed by Gitlab.com. </p>
<p>Also, Sisense&#8217;s CISO Dash just sent an update to customers directly. The latest advice from the company is far more detailed, and involves resetting a potentially large number of access tokens across multiple technologies, including Microsoft Active Directory credentials, GIT credentials, web access tokens, and any single sign-on (SSO) secrets or tokens. </p>
<p>The full message from Dash to customers is below:</p>
<p>&#8220;Good Afternoon,</p>
<p>We are following up on our prior communication of April 10, 2024, regarding reports that certain Sisense company information may have been made available on a restricted access server. As noted, we are taking this matter seriously and our investigation remains ongoing.</p>
<p>Our customers must reset any keys, tokens, or other credentials in their environment used within the Sisense application.</p>
<p>Specifically, you should:<br />
&#8211; Change Your Password: Change all Sisense-related passwords on http://my.sisense.com<br />
&#8211; Non-SSO:<br />
    &#8211; Replace the Secret in the Base Configuration Security section with your GUID/UUID.<br />
    &#8211; Reset passwords for all users in the Sisense application.<br />
    &#8211; Logout all users by running GET /api/v1/authentication/logout_all under Admin user.<br />
&#8211; Single Sign-On (SSO):<br />
    &#8211; If you use SSO JWT for the user’s authentication in Sisense, you will need to update sso.shared_secret in Sisense and then use the newly generated value on the side of the SSO handler.<br />
    &#8211; We strongly recommend rotating the x.509 certificate for your SSO SAML identity provider.<br />
    &#8211; If you utilize OpenID, it’s imperative to rotate the client secret as well.<br />
    &#8211; Following these adjustments, update the SSO settings in Sisense with the revised values.<br />
    &#8211; Logout all users by running GET /api/v1/authentication/logout_all under Admin user.<br />
&#8211; Customer Database Credentials: Reset credentials in your database that were used in the Sisense application to ensure continuity of connection between the systems.<br />
&#8211; Data Models: Change all usernames and passwords in the database connection string in the data models.<br />
&#8211; User Params: If you are using the User Params feature, reset them.<br />
&#8211; Active Directory/LDAP: Change the username and user password of users whose authorization is used for AD synchronization.<br />
&#8211; HTTP Authentication for GIT: Rotate the credentials in every GIT project.<br />
&#8211; B2D Customers: Use the following API PATCH api/v2/b2d-connection in the admin section to update the B2D connection.<br />
&#8211; Infusion Apps: Rotate the associated keys.<br />
&#8211; Web Access Token: Rotate all tokens.<br />
&#8211; Custom Email Server: Rotate associated credentials.<br />
&#8211; Custom Code: Reset any secrets that appear in custom code Notebooks.</p>
<p>If you need any assistance, please submit a customer support ticket at https://community.sisense.com/t5/support-portal/bd-p/SupportPortal and mark it as critical. We have a dedicated response team on standby to assist with your requests.</p>
<p>At Sisense, we give paramount importance to security and are committed to our customers’ success. Thank you for your partnership and commitment to our mutual security.</p>
<p>Regards,</p>
<p>Sangram Dash<br />
Chief Information Security Officer&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67102
title: Crickets from Chirp Systems in Smart Lock Key Leak
uri: Crickets-from-Chirp-Systems-in-Smart-Lock-Key-Leak
url: https://krebsonsecurity.com/2024/04/crickets-from-chirp-systems-in-smart-lock-key-leak/
content:
<p>The U.S. government is warning that &#8220;smart locks&#8221; securing entry to an estimated 50,000 dwellings nationwide contain hard-coded credentials that can be used to remotely open any of the locks. The lock&#8217;s maker <strong>Chirp Systems</strong> remains unresponsive, even though it was first notified about the critical weakness in March 2021. Meanwhile, Chirp&#8217;s parent company, <strong>RealPage, Inc.</strong>, is being sued by multiple U.S. states for allegedly colluding with landlords to illegally raise rents.</p>
<p><img decoding="async" class="aligncenter wp-image-67129" src="media/b6179640.chirpsystems.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems.png" alt="" width="751" height="451" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems.png 1309w, https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems-768x462.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems-782x470.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>On March 7, 2024, the <strong>U.S. Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA) <a href="https://www.cisa.gov/news-events/ics-advisories/icsa-24-067-01" target="_blank" rel="noopener">warned</a> about a remotely exploitable vulnerability with &#8220;low attack complexity&#8221; in Chirp Systems smart locks.</p>
<p>&#8220;Chirp Access improperly stores credentials within its source code, potentially exposing sensitive information to unauthorized access,&#8221; CISA&#8217;s alert warned, assigning the bug a CVSS (badness) rating of 9.1 (out of a possible 10). &#8220;Chirp Systems has not responded to requests to work with CISA to mitigate this vulnerability.&#8221;</p>
<p><strong>Matt Brown</strong>, the researcher CISA credits with reporting the flaw, is a senior systems development engineer at Amazon Web Services. Brown said he discovered the weakness and reported it to Chirp in March 2021, after the company that manages his apartment building started using Chirp smart locks and told everyone to install Chirp&#8217;s app to get in and out of their apartments.</p>
<p>&#8220;I use Android, which has a pretty simple workflow for downloading and decompiling the APK apps,&#8221; Brown told KrebsOnSecurity. &#8220;Given that I am pretty picky about what I trust on my devices, I downloaded Chirp and after decompiling, found that they were storing passwords and private key strings in a file.&#8221;</p>
<p>Using those hard-coded credentials, Brown found an attacker could then connect to an application programming interface (API) that Chirp uses which is managed by smart lock vendor <strong>August.com</strong>, and use that to enumerate and remotely lock or unlock any door in any building that uses the technology.<span id="more-67102"></span></p>
<p>Brown said when he complained to his leasing office, they sold him a small $50 key fob that uses Near-Field Communications (NFC) to toggle the lock when he brings the fob close to his front door. But he said the fob doesn&#8217;t eliminate the ability for anyone to remotely unlock his front door using the exposed credentials and the Chirp mobile app.</p>
<div id="attachment_67131" style="width: 662px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67131" decoding="async" loading="lazy" class="size-full wp-image-67131" src="media/a4271f38.camdenchirp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/camdenchirp.png" alt="" width="652" height="698" /><p id="caption-attachment-67131" class="wp-caption-text">A smart lock enabled with Chirp. Image: Camdenliving.com</p></div>
<p>Also, the fobs pass the credentials to his front door over the air in plain text, meaning someone could clone the fob just by bumping against him with <a href="https://play.google.com/store/apps/details?id=com.wakdev.wdnfc&amp;hl=en_US&amp;gl=US" target="_blank" rel="noopener">a smartphone app</a> made to read and write NFC tags.</p>
<p>Neither August nor Chirp Systems responded to requests for comment. It&#8217;s unclear exactly how many apartments and other residences are using the vulnerable Chirp locks, but multiple articles about the company from 2020 state that approximately 50,000 units use Chirp smart locks with August&#8217;s API.</p>
<p>Roughly a year before Brown reported the flaw to Chirp Systems, the company was bought by <strong>RealPage</strong>, a firm founded in 1998 as a developer of multifamily property management and data analytics software. In 2021, RealPage was acquired by the private equity giant <a href="https://en.wikipedia.org/wiki/Thoma_Bravo" target="_blank" rel="noopener">Thoma Bravo</a>.</p>
<p>Brown said the exposure he found in Chirp&#8217;s products is &#8220;an obvious flaw that is super easy to fix.&#8221;</p>
<p>&#8220;It&#8217;s just a matter of them being motivated to do it,&#8221; he said. &#8220;But they&#8217;re part of a private equity company now, so they&#8217;re not answerable to anybody. It&#8217;s too bad, because it&#8217;s not like residents of [the affected] properties have another choice. It&#8217;s either agree to use the app or move.&#8221;</p>
<p>In October 2022, <a href="https://www.propublica.org/article/yieldstar-rent-increase-realpage-rent" target="_blank" rel="noopener">an investigation</a> by <em>ProPublica</em> examined RealPage&#8217;s dominance in the rent-setting software market, and that it found &#8220;uses a mysterious algorithm to help landlords push the highest possible rents on tenants.&#8221;</p>
<p>&#8220;For tenants, the system upends the practice of negotiating with apartment building staff,&#8221; ProPublica found. &#8220;RealPage discourages bargaining with renters and has even recommended that landlords in some cases accept a lower occupancy rate in order to raise rents and make more money. One of the algorithm’s developers told ProPublica that leasing agents had &#8216;too much empathy&#8217; compared to computer generated pricing.&#8221;</p>
<p>Last year, the U.S. Department of Justice <a href="https://www.propublica.org/article/doj-backs-tenants-price-fixing-case-big-landlords-real-estate-tech" target="_blank" rel="noopener">threw its weight behind</a> a massive lawsuit filed by dozens of tenants who are accusing the $9 billion apartment software company of helping landlords collude to inflate rents.</p>
<p>In February 2024, attorneys general for Arizona and the District of Columbia sued RealPage, alleging RealPage&#8217;s software helped create a rental monopoly.</p>


feed_id: https://krebsonsecurity.com/?p=67190
title: Who Stole 3.6M Tax Records from South Carolina?
uri: Who-Stole-3-6M-Tax-Records-from-South-Carolina
url: https://krebsonsecurity.com/2024/04/who-stole-3-6m-tax-records-from-south-carolina/
content:
<p><img decoding="async" class="aligncenter wp-image-42398" src="media/69b57c63.taxthiefa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/taxthiefa.png" alt="" width="750" height="275" /></p>
<p>For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the state&#8217;s revenue department in 2012 and stealing tax and bank account information for 3.6 million people. The answer may no longer be a mystery: KrebsOnSecurity found compelling clues suggesting the intrusion was carried out by the same Russian hacking crew that stole of millions of payment card records from big box retailers like <strong>Home Depot</strong> and <strong>Target</strong> in the years that followed.</p>
<p>Questions about who stole tax and financial data on roughly three quarters of all South Carolina residents came to the fore last week at the confirmation hearing of <strong>Mark Keel</strong>, who was appointed in 2011 by <strong>Gov. Nikki Haley</strong> to head the state&#8217;s law enforcement division. If approved, this would be Keel&#8217;s third six-year term in that role.</p>
<p><em>The Associated Press</em> <a href="https://apnews.com/article/south-carolina-hacking-tax-returns-2012-5984ce1c6f47938da7a671d0fccadd22" target="_blank" rel="noopener">reports</a> that Keel was careful not to release many details about the breach at his hearing, telling lawmakers he knows who did it but that he wasn&#8217;t ready to name anyone.</p>
<p>&#8220;I think the fact that we didn&#8217;t come up with a whole lot of people&#8217;s information that got breached is a testament to the work that people have done on this case,&#8221; Keel asserted.</p>
<p>A ten-year <a href="//www.postandcourier.com/columbia/news/scs-massive-data-breach-10-years-later-questions-linger-as-investigation-remains-open/article_29dd8164-4025-11ed-9433-73cafd23fadb.html" target="_blank" rel="noopener">retrospective</a> published in 2022 by <em>The Post and Courier</em> in Columbia, S.C. said investigators determined the breach began on Aug. 13, 2012, after a state IT contractor clicked a malicious link in an email. State officials said they found out about the hack from federal law enforcement on October 10, 2012.</p>
<p>KrebsOnSecurity examined posts across dozens of cybercrime forums around that time, and found only one instance of someone selling large volumes of tax data in the year surrounding the breach date.</p>
<p>On Oct. 7, 2012 &#8212; three days before South Carolina officials say they first learned of the intrusion &#8212; a notorious cybercriminal who goes by the handle &#8220;<strong>Rescator</strong>&#8221; advertised the sale of &#8220;a database of the tax department of one of the states.&#8221;</p>
<p>&#8220;Bank account information, SSN and all other information,&#8221; Rescator&#8217;s sales thread on the Russian-language crime forum <strong>Embargo</strong> read. &#8220;If you purchase the entire database, I will give you access to it.&#8221;</p>
<p>A week later, Rescator posted a similar offer on the exclusive Russian forum <strong>Mazafaka</strong>, saying he was selling information from a U.S. state tax database, without naming the state. Rescator said the data exposed included Social Security Number (SSN), employer, name, address, phone, taxable income, tax refund amount, and bank account number.</p>
<p>&#8220;There is a lot of information, I am ready to sell the entire database, with access to the database, and in parts,&#8221; Rescator told Mazafaka members. &#8220;There is also information on corporate taxpayers.&#8221;<span id="more-67190"></span></p>
<p>On Oct. 26, 2012, the state announced the breach publicly. State officials said they were working with investigators from the <strong>U.S. Secret Service</strong> and digital forensics experts from Mandiant, which produced <a href="media/6205ba3e.Mandiant20Report_0.pdf" data-original-source="https://oag.ca.gov/system/files/Mandiant%20Report_0.pdf" target="_blank" rel="noopener">an incident report</a> (PDF) that was later published by South Carolina Dept. of Revenue. KrebsOnSecurity sought comment from the Secret Service, South Carolina prosecutors, and Mr. Keel&#8217;s office. This story will be updated if any of them respond.</p>
<p>On Nov. 18, 2012, Rescator told fellow denizens of the forum <strong>Verified</strong> he was selling a database of 65,000 records with bank account information from several smaller, regional financial institutions. Rescator&#8217;s sales thread on Verified listed more than a dozen database fields, including account number, name, address, phone, tax ID, date of birth, employer and occupation.</p>
<p>Asked to provide more context about the database for sale, Rescator told forum members the database included financial records related to tax filings of a U.S. state. Rescator added that there was a second database of around 80,000 corporations that included social security numbers, names and addresses, but no financial information.</p>
<p>The AP says South Carolina paid $12 million to Experian for identity theft protection and credit monitoring for its residents after the breach.</p>
<p>&#8220;At the time, it was one of the largest breaches in U.S. history but has since been surpassed greatly by hacks to Equifax, Yahoo, Home Depot, Target and PlayStation,&#8221; the AP&#8217;s <strong>Jeffrey Collins</strong> wrote.</p>
<p>As it happens, Rescator&#8217;s criminal hacking crew was directly responsible for <a href="https://krebsonsecurity.com/tag/target-breach/" target="_blank" rel="noopener">the 2013 breach at Target</a> and the 2014 <a href="https://krebsonsecurity.com/tag/home-depot-breach/" target="_blank" rel="noopener">hack of Home Depot</a>. The Target intrusion saw Rescator&#8217;s cybercrime shops selling roughly 40 million stolen payment cards, and 56 million cards from Home Depot customers.</p>
<p>Who is Rescator? On Dec. 14, 2023, KrebsOnSecurity published the results of <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">a 10-year investigation into the identity of Rescator</a>, a.k.a. <strong>Mikhail Borisovich Shefel</strong>, a 36-year-old who lives in Moscow and who recently changed his last name to Lenin.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67207" src="media/ddbe5ba2.shefel-fb1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1.png" alt="" width="750" height="572" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1.png 942w, https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1-768x585.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1-782x596.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Mr. Keel&#8217;s assertion that somehow the efforts of South Carolina officials following the breach may have lessened its impact on citizens seems unlikely. The stolen tax and financial data appears to have been sold openly on cybercrime forums by one of the Russian underground&#8217;s most aggressive and successful hacking crews.</p>
<p>While there are no indications from reviewing forum posts that Rescator ever sold the data, his sales threads came at a time when the incidence of <a href="https://krebsonsecurity.com/category/tax-refund-fraud/" target="_blank" rel="noopener">tax refund fraud</a> was skyrocketing.</p>
<p>Tax-related identity theft occurs when someone uses a stolen identity and SSN to file a tax return in that person&#8217;s name claiming a fraudulent refund. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, <em>as can those who are not actually owed a refund</em> from the <strong>U.S. Internal Revenue Service</strong> (IRS).</p>
<p>According to <a title="http://www.cbsnews.com/news/irs-refunded-4-billion-to-identity-thieves-last-year-inspector-generals-report-says/" href="http://www.cbsnews.com/news/irs-refunded-4-billion-to-identity-thieves-last-year-inspector-generals-report-says/" target="_blank" rel="noopener">a 2013 report</a> from the Treasury Inspector General’s office, the IRS issued nearly $4 billion in bogus tax refunds in 2012, and more than $5.8 billion in 2013. The money largely was sent to people who stole SSNs and other information on U.S. citizens, and then filed fraudulent tax returns on those individuals claiming a large refund but at a different address.</p>
<p>It remains unclear why Shefel has never been officially implicated in the breaches at Target, Home Depot, or in South Carolina. It may be that Shefel <em>has</em> been indicted, and that those indictments remain sealed for some reason. Perhaps prosecutors were hoping Shefel would decide to leave Russia, at which point it would be easier to apprehend him if he believed no one was looking for him.</p>
<p>But all signs are that Shefel is deeply rooted in Russia, and has no plans to leave. In January 2024, authorities in Australia, the United States and the U.K. levied financial sanctions against 33-year-old Russian man <strong>Aleksandr Ermakov</strong> for allegedly stealing data on 10 million customers of the Australian health insurance giant Medibank.</p>
<p>A week after those sanctions were put in place, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/01/who-is-alleged-medibank-hacker-aleksandr-ermakov/" target="_blank" rel="noopener">a deep dive on Ermakov</a>, which found that he co-ran a Moscow-based IT security consulting business along with Mikhail Shefel called<strong> Shtazi-IT</strong>.</p>
<div id="attachment_66196" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66196" decoding="async" loading="lazy" class=" wp-image-66196" src="media/d0187576.shtazi-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru.png" alt="" width="749" height="307" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru.png 1806w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-768x315.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-1536x629.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-782x320.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66196" class="wp-caption-text">A Google-translated version of Shtazi dot ru. Image: Archive.org.</p></div>


feed_id: https://krebsonsecurity.com/?p=67255
title: Russian FSB Counterintelligence Chief Gets 9 Years in Cybercrime Bribery Scheme
uri: Russian-FSB-Counterintelligence-Chief-Gets-9-Years-in-Cybercrime-Bribe
url:
https://krebsonsecurity.com/2024/04/russian-fsb-counterintelligence-chief-gets-9-years-in-cybercrime-bribery-scheme/

content:
<p>The head of counterintelligence for a division of the Russian <strong>Federal Security Service</strong> (FSB) was sentenced last week to nine years in a penal colony for accepting a USD $1.7 million bribe to ignore the activities of a prolific Russian cybercrime group that hacked thousands of e-commerce websites. The protection scheme was exposed in 2022 when Russian authorities arrested six members of the group, which sold millions of stolen payment cards at flashy online shops like <strong>Trump&#8217;s Dumps</strong>.</p>
<div id="attachment_39492" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-39492" decoding="async" class=" wp-image-39492" src="media/ad4460b9.trumpsdumps-580x395.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png" alt="" width="750" height="511" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-768x524.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-940x641.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps.png 1295w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-39492" class="wp-caption-text">A now-defunct carding shop that sold stolen credit cards and invoked 45&#8217;s likeness and name.</p></div>
<p>As <a href="https://therecord.media/former-fsb-officer-sentenced-russia-helping-hackers" target="_blank" rel="noopener">reported</a> by <em>The Record</em>, a Russian court last week sentenced former FSB officer <strong>Grigory Tsaregorodtsev</strong> for taking a $1.7 million bribe from a cybercriminal group that was seeking a &#8220;roof,&#8221; a well-placed, corrupt law enforcement official who could be counted on to both disregard their illegal hacking activities and run interference with authorities in the event of their arrest.</p>
<p>Tsaregorodtsev was head of the counterintelligence department for a division of the FSB based in Perm, Russia. In February 2022, Russian <a href="https://krebsonsecurity.com/2022/02/russian-govt-continues-carding-shop-crackdown/" target="_blank" rel="noopener">authorities arrested six men in the Perm region</a> accused of selling stolen payment card data. They also seized multiple carding shops run by the gang, including <strong>Ferum Shop</strong>, <strong>Sky-Fraud</strong>, and <strong>Trump&#8217;s Dumps</strong>, a popular fraud store that invoked the 45th president’s likeness and promised to &#8220;make credit card fraud great again.&#8221;</p>
<p>All of the domains seized in that raid were registered by an IT consulting company in Perm called <strong>Get-net LLC</strong>, which was owned in part by <strong>Artem Zaitsev</strong> &#8212; one of the six men arrested. Zaitsev reportedly was a well-known programmer whose company supplied services and leasing to the local FSB field office.<span id="more-67255"></span></p>
<div id="attachment_58442" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58442" decoding="async" loading="lazy" class=" wp-image-58442" src="media/e85102c0.deptk-td.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/deptk-td.png" alt="" width="749" height="483" /><p id="caption-attachment-58442" class="wp-caption-text">The message for Trump&#8217;s Dumps users left behind by Russian authorities that seized the domain in 2022.</p></div>
<p>Russian news sites report that Internal Affairs officials with the FSB grew suspicious when Tsaregorodtsev became a little too interested in the case following the hacking group&#8217;s arrests. The former FSB agent had reportedly assured the hackers he could have their case transferred and that they would soon be free.</p>
<p>But when that promised freedom didn&#8217;t materialize, four the of the defendants pulled the walls down on the scheme and brought down their own roof. The FSB arrested Tsaregorodtsev, and seized $154,000 in cash, 100 gold bars, real estate and expensive cars.</p>
<p>At Tsaregorodtsev&#8217;s trial, his lawyers argued that their client wasn&#8217;t guilty of bribery per se, but that he did admit to fraud because he was ultimately unable to fully perform the services for which he&#8217;d been hired.</p>
<p>The Russian news outlet <em>Kommersant</em> reports that all four of those who cooperated were released with probation or correctional labor. Zaitsev received a sentence of 3.5 years in prison, and defendant <strong>Alexander Kovalev</strong> got four years.</p>
<p>In 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/" target="_blank" rel="noopener">profiled Trump&#8217;s Dumps</a>, and found the contact address listed on the site was tied to an email address used to register more than a dozen domains that were made to look like legitimate Javascript calls many e-commerce sites routinely make to process transactions &#8212; such as &#8220;js-link[dot]su,&#8221; &#8220;js-stat[dot]su,&#8221; and &#8220;js-mod[dot]su.&#8221;</p>
<p>Searching on those malicious domains revealed <a href="https://web.archive.org/web/20161114152809/https://www.riskiq.com/blog/labs/magecart-keylogger-injection/" target="_blank" rel="noopener">a 2016 report from RiskIQ</a>, which shows the domains featured prominently in a series of hacking campaigns against e-commerce websites. According to RiskIQ, the attacks targeted online stores running outdated and unpatched versions of shopping cart software from <strong>Magento</strong>, <strong>Powerfront</strong> and <strong>OpenCart</strong>.</p>
<p>Those shopping cart flaws allowed the crooks to install &#8220;web skimmers,&#8221; malicious Javascript used to steal credit card details and other information from payment forms on the checkout pages of vulnerable e-commerce sites. The stolen customer payment card details were then sold on sites like Trump&#8217;s Dumps and Sky-Fraud.</p>


feed_id: https://krebsonsecurity.com/?p=67297
title: FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data
uri: FCC-Fines-Major-U-S-Wireless-Carriers-for-Selling-Customer-Location-D
url:
https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/

content:
<p>The <strong>U.S. Federal Communications Commission</strong> (FCC) today levied fines totaling nearly $200 million against the four major carriers &#8212; including <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong> &#8212; for illegally sharing access to customers&#8217; location information without consent.</p>
<p><img decoding="async" class="aligncenter wp-image-43845" src="media/f262877a.locationtracking.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/locationtracking.jpg" alt="" width="744" height="482" /></p>
<p>The fines mark the culmination of a more than four-year investigation into the actions of the major carriers. In February 2020, the FCC put all four wireless providers on notice that their practices of sharing access to customer location data were likely violating the law.</p>
<p>The FCC said it found the carriers each sold access to its customers&#8217; location information to &#8216;aggregators,&#8217; who then resold access to the information to third-party location-based service providers.</p>
<p>&#8220;In doing so, each carrier attempted to offload its obligations to obtain customer consent onto downstream recipients of location information, which in many instances meant that no valid customer consent was obtained,&#8221; <a href="https://www.fcc.gov/document/fcc-fines-largest-wireless-carriers-sharing-location-data" target="_blank" rel="noopener">an FCC statement</a> on the action reads. &#8220;This initial failure was compounded when, after becoming aware that their safeguards were ineffective, the carriers continued to sell access to location information without taking reasonable measures to protect it from unauthorized access.&#8221;</p>
<p>The FCC&#8217;s <a href="media/a40b0964.FCC-24-40A1.pdf" data-original-source="https://docs.fcc.gov/public/attachments/FCC-24-40A1.pdf" target="_blank" rel="noopener">findings against AT&amp;T</a>, for example, show that AT&amp;T sold customer location data directly or indirectly to at least 88 third-party entities. The FCC <a href="media/d4189fc0.FCC-24-41A1.pdf" data-original-source="https://docs.fcc.gov/public/attachments/FCC-24-41A1.pdf" target="_blank" rel="noopener">found</a> Verizon sold access to customer location data (indirectly or directly) to 67 third-party entities. Location data for Sprint customers found its way to 86 third-party entities, and to 75 third-parties in the case of T-Mobile customers.</p>
<p>The commission said it took action after <strong>Sen. Ron Wyden</strong> (D-Ore.) <a href="media/74c29b4d.wyden-securus-location-tracking-letter-to-fcc.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/wyden-securus-location-tracking-letter-to-fcc.pdf" target="_blank" rel="noopener">sent a letter to the FCC</a> detailing how a company called <strong>Securus Technologies</strong> had been selling location data on customers of virtually any major mobile provider to law enforcement officials.</p>
<p>That same month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the news</a> that <strong>LocationSmart</strong> — a data aggregation firm working with the major wireless carriers — had a free, unsecured demo of its service online that anyone could abuse to find the near-exact location of virtually any mobile phone in North America.<span id="more-67297"></span><span id="more-50646"></span></p>
<p>The carriers <a href="https://krebsonsecurity.com/2018/06/verizon-to-stop-sharing-customer-location-data-with-third-parties/" target="_blank" rel="noopener">promised to &#8220;wind down&#8221; location data sharing agreements</a> with third-party companies. But in 2019, reporting at <a href="https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile" target="_blank" rel="noopener">Vice.com showed</a> that little had changed, detailing how reporters were able to locate a test phone after paying $300 to a bounty hunter who simply bought the data through a little-known third-party service.</p>
<p>Sen. Wyden said no one who signed up for a cell plan thought they were giving permission for their phone company to sell a detailed record of their movements to anyone with a credit card.</p>
<p>&#8220;I applaud the FCC for following through on my investigation and holding these companies accountable for putting customers’ lives and privacy at risk,” Wyden said in a statement today.</p>
<p>The FCC fined Sprint and T-Mobile $12 million and $80 million respectively. AT&amp;T was fined more than $57 million, while Verizon received a $47 million penalty. Still, these fines represent a tiny fraction of each carrier&#8217;s annual revenues. For example, $47 million is less than one percent of Verizon&#8217;s total wireless service revenue in 2023, which was nearly $77 billion.</p>
<p>The fine amounts vary because they were calculated based in part on the number of days that the carriers continued sharing customer location data after being notified that doing so was illegal (the agency also considered the number of active third-party location data sharing agreements). The FCC notes that AT&amp;T and Verizon each took more than 320 days from the publication of the Times story to wind down their data sharing agreements; T-Mobile took 275 days; Sprint kept sharing customer location data for 386 days.</p>
<p><strong>Update, 6:25 p.m. ET:</strong> Clarified that the FCC launched its investigation at the request of Sen. Wyden.</p>


feed_id: https://krebsonsecurity.com/?p=67317
title: Man Who Mass-Extorted Psychotherapy Patients Gets Six Years
uri: Man-Who-Mass-Extorted-Psychotherapy-Patients-Gets-Six-Years
url: https://krebsonsecurity.com/2024/04/man-who-mass-extorted-psychotherapy-patients-gets-six-years/
content:
<p>A 26-year-old Finnish man was sentenced to more than six years in prison today after being convicted of hacking into an online psychotherapy clinic, leaking tens of thousands of patient therapy records, and attempting to extort the clinic and patients.</p>
<p><img decoding="async" class="aligncenter  wp-image-61773" src="media/0074dfea.kikmaki-wanted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png" alt="" width="750" height="357" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png 2936w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-768x366.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-1536x731.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-2048x975.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-782x372.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>On October 21, 2020, the <strong>Vastaamo Psychotherapy Center</strong> in Finland became the target of blackmail when a tormentor identified as “ransom_man” demanded payment of 40 bitcoins (~450,000 euros at the time) in return for a promise not to publish highly sensitive therapy session notes Vastaamo had exposed online.</p>
<p>Ransom_man announced on the dark web that he would start publishing 100 patient profiles every 24 hours. When Vastaamo declined to pay, ransom_man shifted to extorting individual patients. According to Finnish police, some 22,000 victims reported extortion attempts targeting them personally, targeted emails that threatened to publish their therapy notes online unless paid a 500 euro ransom.</p>
<p>Finnish prosecutors quickly zeroed in on a suspect:<strong> Julius &#8220;Zeekill&#8221; Kivimäki</strong>, a notorious criminal hacker convicted of committing tens of thousands of cybercrimes before he became an adult. After being charged with the attack in October 2022, Kivimäki fled the country. He was <a href="https://krebsonsecurity.com/2023/02/finlands-most-wanted-hacker-nabbed-in-france/" target="_blank" rel="noopener">arrested four months later in France</a>, hiding out under an assumed name and passport.</p>
<p><strong>Antti Kurittu</strong> is a former criminal investigator who worked on an investigation involving Kivimäki’s use of the Zbot botnet, among other activities Kivimäki engaged in as a member of the hacker group <a href="https://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-lenovo-google-domains/" target="_blank" rel="noopener">Hack the Planet</a> (HTP).</p>
<p>Kurittu said the prosecution had demanded at least seven years in jail, and that the sentence handed down was six years and three months. Kurittu said prosecutors knocked a few months off of Kivimäki&#8217;s sentence because he agreed to pay compensation to his victims, and that Kivimäki will remain in prison during any appeal process.</p>
<p>&#8220;I think the sentencing was as expected, knowing the Finnish judicial system,&#8221; Kurittu told KrebsOnSecurity. &#8220;As Kivimäki has not been sentenced to a non-suspended prison sentence during the last five years, he will be treated as a first-timer, his previous convictions notwithstanding.&#8221;</p>
<p>But because juvenile convictions in Finland don&#8217;t count towards determining whether somebody is a first-time offender, Kivimäki will end up serving approximately half of his sentence.</p>
<p>&#8220;This seems like a short sentence when taking into account the gravity of his actions and the life-altering consequences to thousands of people, but it&#8217;s almost the maximum the law allows for,&#8221; Kurittu said.<span id="more-67317"></span></p>
<p>Kivimäki initially gained notoriety as a self-professed member of the <a href="https://krebsonsecurity.com/tag/lizard-squad/" target="_blank" rel="noopener">Lizard Squad</a>, a mainly low-skilled hacker group that specialized in DDoS attacks. But American and Finnish investigators say Kivimäki’s involvement in cybercrime dates back to at least 2008, when he was introduced to a founding member of what would soon become HTP.</p>
<p>Finnish police said Kivimäki also used the nicknames “Ryan”, “RyanC” and “Ryan Cleary” (Ryan Cleary was actually a member of a rival hacker group — <a href="https://en.wikipedia.org/wiki/LulzSec" target="_blank" rel="noopener">LulzSec</a> — who was sentenced to prison for hacking).</p>
<p>Kivimäki and other HTP members were involved in mass-compromising web servers using known vulnerabilities, and by 2012 Kivimäki’s alias Ryan Cleary was selling access to those servers in the form of a DDoS-for-hire service. Kivimäki was 15 years old at the time.</p>
<p>In 2013, investigators going through devices seized from Kivimäki found computer code that had been used to crack more than 60,000 web servers using a previously unknown vulnerability in <strong>Adobe’s ColdFusion</strong> software. KrebsOnSecurity detailed the work of HTP in September 2013, after the group <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank" rel="noopener">compromised servers inside data brokers LexisNexis, Kroll, and Dun &amp; Bradstreet</a>.</p>
<p>The group used the same ColdFusion flaws <a href="https://krebsonsecurity.com/2013/10/data-broker-hackers-also-compromised-nw3c/" target="_blank" rel="noopener">to break into the National White Collar Crime Center (NWC3)</a>, a non-profit that provides research and investigative support to the <strong>U.S. Federal Bureau of Investigation</strong> (FBI).</p>
<p>As KrebsOnSecurity reported at the time, this small ColdFusion botnet of data broker servers was being controlled by the same cybercriminals who’d <a href="https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank" rel="noopener">assumed control over <strong>SSNDOB</strong></a>, which operated one of the underground’s most reliable services for obtaining Social Security Number, dates of birth and credit file information on U.S. residents.</p>
<p>Kivimäki was responsible for making <a href="http://www.forbes.com/sites/insertcoin/2014/08/24/sony-online-entertainment-presidents-flight-diverted-by-psn-hackers-bomb-threat/" target="_blank" rel="noopener">an August 2014 bomb threat</a> against former <strong>Sony Online Entertainment President John Smedley</strong> that grounded an American Airlines plane. Kivimäki also was involved in calling in multiple fake bomb threats and “swatting” incidents — reporting fake hostage situations at an address to prompt a heavily armed police response to that location.</p>
<p><strong>Ville Tapio,</strong> the former CEO of Vastaamo, was fired and also prosecuted following the breach. Ransom_man bragged about Vastaamo&#8217;s sloppy security, noting the company had used the laughably weak username and password &#8220;root/root&#8221; to protect sensitive patient records.</p>
<p>Investigators later found Vastaamo had originally been hacked in 2018 and again in 2019. In April 2023, a Finnish court handed down <a href="https://yle.fi/a/74-20027665" target="_blank" rel="noopener">a three-month sentence for Tapio</a>, but that sentence was suspended because he had no previous criminal record.</p>


feed_id: https://krebsonsecurity.com/?p=67184
title: Why Your VPN May Not Be As Secure As It Claims
uri: Why-Your-VPN-May-Not-Be-As-Secure-As-It-Claims
url: https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
content:
<p>Virtual private networking (VPN) companies market their services as a way to prevent anyone from snooping on your Internet usage. But new research suggests this is a dangerous assumption when connecting to a VPN via an untrusted network, because attackers on the same network could force a target&#8217;s traffic off of the protection provided by their VPN without triggering any alerts to the user.</p>
<div id="attachment_67354" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67354" decoding="async" class=" wp-image-67354" src="media/3a105e34.tunnelvision.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/tunnelvision.png" alt="" width="750" height="569" /><p id="caption-attachment-67354" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>When a device initially tries to connect to a network, it broadcasts a message to the entire local network stating that it is requesting an Internet address. Normally, the only system on the network that notices this request and replies is the router responsible for managing the network to which the user is trying to connect.</p>
<p>The machine on a network responsible for fielding these requests is called a <strong>Dynamic Host Configuration Protocol</strong> (DHCP) server, which will issue time-based leases for IP addresses. The DHCP server also takes care of setting a specific local address &#8212; known as an <strong>Internet gateway</strong> &#8212; that all connecting systems will use as a primary route to the Web.</p>
<p>VPNs work by creating a virtual network interface that serves as an encrypted tunnel for communications. But researchers at <strong>Leviathan Security</strong> say they&#8217;ve discovered it&#8217;s possible to abuse an obscure feature built into the DHCP standard so that other users on the local network are forced to connect to a rogue DHCP server.</p>
<p>&#8220;Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway,&#8221; Leviathan researchers <strong>Lizzie Moratti</strong> and <strong>Dani Cronce</strong> wrote. &#8220;When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.&#8221;</p>
<p>The feature being abused here is known as <a href="https://datatracker.ietf.org/doc/html/rfc3442" target="_blank" rel="noopener">DHCP option 121</a>, and it allows a DHCP server to set a route on the VPN user&#8217;s system that is more specific than those used by most VPNs. Abusing this option, Leviathan found, effectively gives an attacker on the local network the ability to set up routing rules that have a higher priority than the routes for the virtual network interface that the target&#8217;s VPN creates.</p>
<p>&#8220;Pushing a route also means that the network traffic will be sent over the same interface as the DHCP server instead of the virtual network interface,&#8221; the Leviathan researchers said. &#8220;This is intended functionality that isn’t clearly stated in the RFC [standard]. Therefore, for the routes we push, it is never encrypted by the VPN’s virtual interface but instead transmitted by the network interface that is talking to the DHCP server. As an attacker, we can select which IP addresses go over the tunnel and which addresses go over the network interface talking to our DHCP server.&#8221;</p>
<p>Leviathan found they could force VPNs on the local network that already had a connection to arbitrarily request a new one. In this well-documented tactic, known as a <a href="https://www.prosec-networks.com/en/blog/dhcp-starvation-attack/" target="_blank" rel="noopener">DHCP starvation attack</a>, an attacker floods the DHCP server with requests that consume all available IP addresses that can be allocated. Once the network&#8217;s legitimate DHCP server is completely tied up, the attacker can then have their rogue DHCP server respond to all pending requests.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/ajsLmZia6UU?si=OYDck1VdGoLF0XFU" width="750" height="415" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&#8220;This technique can also be used against an already established VPN connection once the VPN user’s host needs to renew a lease from our DHCP server,&#8221; the researchers wrote. &#8220;We can artificially create that scenario by setting a short lease time in the DHCP lease, so the user updates their routing table more frequently. In addition, the VPN control channel is still intact because it already uses the physical interface for its communication. In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.&#8221;</p>
<p>The researchers say their methods could be used by an attacker who compromises a DHCP server or wireless access point, or by a rogue network administrator who owns the infrastructure themselves and maliciously configures it. Alternatively, an attacker could set up an &#8220;<a href="https://www.techtarget.com/searchsecurity/definition/evil-twin" target="_blank" rel="noopener">evil twin</a>&#8221; wireless hotspot that mimics the signal broadcast by a legitimate provider.</p>
<p><H2>ANALYSIS</H2></p>
<p><strong>Bill Woodcock</strong> is executive director at <a href="http://www.pch.net" target="_blank" rel="noopener">Packet Clearing House</a>, a nonprofit based in San Francisco. Woodcock said Option 121 has been included in the DHCP standard since 2002, which means the attack described by Leviathan has technically been possible for the last 22 years.</p>
<p>&#8220;They&#8217;re realizing now that this can be used to circumvent a VPN in a way that&#8217;s really problematic, and they&#8217;re right,&#8221; Woodcock said.</p>
<p>Woodcock said anyone who might be a target of spear phishing attacks should be very concerned about using VPNs on an untrusted network.</p>
<p>&#8220;Anyone who is in a position of authority or maybe even someone who is just a high net worth individual, those are all very reasonable targets of this attack,&#8221; he said. &#8220;If I were trying to do an attack against someone at a relatively high security company and I knew where they typically get their coffee or sandwich at twice a week, this is a very effective tool in that toolbox. I&#8217;d be a little surprised if it wasn&#8217;t already being exploited in that way, because again this isn&#8217;t rocket science. It&#8217;s just thinking a little outside the box.&#8221;<span id="more-67184"></span></p>
<p>Successfully executing this attack on a network likely would not allow an attacker to see all of a target&#8217;s traffic or browsing activity. That&#8217;s because for the vast majority of the websites visited by the target, the content is encrypted (the site&#8217;s address begins with https://). However, an attacker would still be able to see the metadata &#8212; such as the source and destination addresses &#8212; of any traffic flowing by.</p>
<p>KrebsOnSecurity shared Leviathan&#8217;s research with <a href="https://www.netscout.com/asert/john-kristoff" target="_blank" rel="noopener">John Kristoff</a>, founder of <a href="https://dataplane.org/" rel="noopener" target="_blank">dataplane.org</a> and a PhD candidate in computer science at the <strong>University of Illinois Chicago</strong>. Kristoff said practically all user-edge network gear, including WiFi deployments, support some form of rogue DHCP server detection and mitigation, but that it&#8217;s unclear how widely deployed those protections are in real-world environments.</p>
<p>&#8220;However, and I think this is a key point to emphasize, an untrusted network is an untrusted network, which is why you&#8217;re usually employing the VPN in the first place,&#8221; Kristoff said. &#8220;If [the] local network is inherently hostile and has no qualms about operating a rogue DHCP server, then this is a sneaky technique that could be used to de-cloak some traffic &#8211; and if done carefully, I&#8217;m sure a user might never notice.&#8221;</p>
<h2>MITIGATIONS</h2>
<p>According to Leviathan, there are several ways to minimize the threat from rogue DHCP servers on an unsecured network. One is using a device powered by the <strong>Android</strong> operating system, which apparently ignores DHCP option 121.</p>
<p>Relying on a temporary wireless hotspot controlled by a cellular device you own also effectively blocks this attack.</p>
<p>&#8220;They create a password-locked LAN with automatic network address translation,&#8221; the researchers wrote of cellular hot-spots. &#8220;Because this network is completely controlled by the cellular device and requires a password, an attacker should not have local network access.&#8221;</p>
<p>Leviathan&#8217;s Moratti said another mitigation is to run your VPN from inside of a virtual machine (VM) &#8212; like Parallels, VMware or VirtualBox. VPNs run inside of a VM are not vulnerable to this attack, Moratti said, provided they are not run in &#8220;<a href="https://www.virtualbox.org/manual/ch06.html#network_bridged" rel="noopener" target="_blank">bridged mode</a>,&#8221; which causes the VM to replicate another node on the network.</p>
<p>In addition, a technology called &#8220;deep packet inspection&#8221; can be used to deny all in- and outbound traffic from the physical interface except for the DHCP and the VPN server. However, Leviathan says this approach opens up a potential &#8220;side channel&#8221; attack that could be used to determine the destination of traffic.</p>
<p>&#8220;This could be theoretically done by performing traffic analysis on the volume a target user sends when the attacker&#8217;s routes are installed compared to the baseline,&#8221; they wrote. &#8220;In addition, this selective denial-of-service is unique as it could be used to censor specific resources that an attacker doesn&#8217;t want a target user to connect to even while they are using the VPN.&#8221;</p>
<p>Moratti said Leviathan&#8217;s research shows that many VPN providers are currently making promises to their customers that their technology can&#8217;t keep.</p>
<p>&#8220;VPNs weren&#8217;t designed to keep you more secure on your local network, but to keep your traffic more secure on the Internet,&#8221; Moratti said. &#8220;When you start making assurances that your product protects people from seeing your traffic, there&#8217;s an assurance or promise that can&#8217;t be met.&#8221;</p>
<p>A copy of Leviathan&#8217;s research, along with code intended to allow others to duplicate their findings in a lab environment, is available <a href="https://www.leviathansecurity.com/blog/tunnelvision" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=67380
title: U.S. Charges Russian Man as Boss of LockBit Ransomware Group
uri: U-S-Charges-Russian-Man-as-Boss-of-LockBit-Ransomware-Group
url: https://krebsonsecurity.com/2024/05/u-s-charges-russian-man-as-boss-of-lockbit-ransomware-group/
content:
<p>The United States joined the United Kingdom and Australia today in sanctioning 31-year-old Russian national <strong>Dmitry Yuryevich Khoroshev</strong> as the alleged leader of the infamous ransomware group <strong>LockBit</strong>. The <strong>U.S. Department of Justice</strong> also indicted Khoroshev and charged him with using Lockbit to attack more than 2,000 victims and extort at least $100 million in ransomware payments.</p>
<div id="attachment_67385" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67385" decoding="async" class=" wp-image-67385" src="media/84a30568.lockbitsupp-nca.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/lockbitsupp-nca.png" alt="" width="750" height="526" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/lockbitsupp-nca.png 1174w, https://krebsonsecurity.com/wp-content/uploads/2024/05/lockbitsupp-nca-768x538.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/lockbitsupp-nca-782x548.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/05/lockbitsupp-nca-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67385" class="wp-caption-text">Image: U.K. National Crime Agency.</p></div>
<p>Khoroshev (Дмитрий Юрьевич Хорошев), a resident of Voronezh, Russia, was charged in <a href="https://www.justice.gov/opa/media/1350921/dl?inline" target="_blank" rel="noopener">a 26-count indictment</a> by a grand jury in New Jersey.</p>
<p>&#8220;Dmitry Khoroshev conceived, developed, and administered Lockbit, the most prolific ransomware variant and group in the world, enabling himself and his affiliates to wreak havoc and cause billions of dollars in damage to thousands of victims around the globe,&#8221; <strong>U.S. Attorney Philip R. Sellinger</strong> said in <a href="https://www.justice.gov/opa/pr/us-charges-russian-national-developing-and-operating-lockbit-ransomware" target="_blank" rel="noopener">a statement</a> released by the Justice Department.</p>
<p>The indictment alleges Khoroshev acted as the LockBit ransomware group’s developer and administrator from its inception in September 2019 through May 2024, and that he typically received a 20 percent share of each ransom payment extorted from LockBit victims.</p>
<p>The government says LockBit victims included individuals, small businesses, multinational corporations, hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies.</p>
<p>&#8220;Khoroshev and his co-conspirators extracted at least $500 million in ransom payments from their victims and caused billions of dollars in broader losses, such as lost revenue, incident response, and recovery,&#8221; the DOJ said. &#8220;The LockBit ransomware group attacked more than 2,500 victims in at least 120 countries, including 1,800 victims in the United States.&#8221;</p>
<p>The <a href="https://www.nationalcrimeagency.gov.uk/news/lockbit-leader-unmasked-and-sanctioned" target="_blank" rel="noopener">unmasking of LockBitSupp</a> comes nearly three months after U.S. and U.K. authorities seized the darknet websites run by LockBit, retrofitting it with press releases about the law enforcement action and <a href="https://www.nomoreransom.org/en/decryption-tools.html" target="_blank" rel="noopener">free tools</a> to help LockBit victims decrypt infected systems.</p>
<div id="attachment_66436" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66436" decoding="async" loading="lazy" class=" wp-image-66436" src="media/aadce34b.lockbitseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png" alt="" width="749" height="474" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png 1379w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-768x486.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-782x494.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66436" class="wp-caption-text">The feds used the existing design on LockBit&#8217;s victim shaming website to feature press releases and free decryption tools.</p></div>
<p>One of the blog captions that authorities left on the seized site was a teaser page that read, &#8220;Who is LockbitSupp?,&#8221; which promised to reveal the true identity of the ransomware group leader. That item featured a countdown clock until the big reveal, but when the site&#8217;s timer expired no such details were offered.</p>
<p>Following the FBI&#8217;s raid, LockBitSupp took to Russian cybercrime forums to assure his partners and affiliates that the ransomware operation was still fully operational. LockBitSupp also raised another set of darknet websites that soon promised to release data stolen from a number of LockBit victims ransomed prior to the FBI raid.</p>
<p>One of the victims LockBitSupp continued extorting was Fulton County, Ga. Eve LockBit&#8217;s darknet sites. Following the FBI raid, LockbitSupp <a href="https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/" target="_blank" rel="noopener">vowed to release sensitive documents stolen from the county court system</a> unless paid a ransom demand before LockBit&#8217;s countdown timer expired. But when Fulton County officials <a href="https://krebsonsecurity.com/2024/02/fulton-county-security-experts-call-lockbits-bluff/" target="_blank" rel="noopener">refused to pay</a> and the timer expired, no stolen records were ever published. Experts said it was likely the FBI had in fact seized all of LockBit&#8217;s stolen data.</p>
<p>LockBitSupp also bragged that their real identity would never be revealed, and at one point offered to pay $10 million to anyone who could discover their real name.</p>
<p>KrebsOnSecurity has been in intermittent contact with LockBitSupp for several months over the course of reporting on different LockBit victims. Reached at the same ToX instant messenger identity that the ransomware group leader has promoted on Russian cybercrime forums, LockBitSupp claimed the authorities named the wrong guy.</p>
<p><span class="pullquote pqright">&#8220;It&#8217;s not me,&#8221; LockBitSupp replied in Russian. &#8220;I don&#8217;t understand how the FBI was able to connect me with this poor guy.</span> Where is the logical chain that it is me? Don&#8217;t you feel sorry for a random innocent person?&#8221;</p>
<p>LockBitSupp, who now has a $10 million bounty on his head from the <strong>U.S. Department of State</strong>, has been known to be flexible with the truth. The Lockbit group routinely practiced &#8220;double extortion&#8221; against its victims &#8212; requiring one ransom payment for a key to unlock hijacked systems, and a separate payment in exchange for a promise to delete data stolen from its victims.</p>
<p>But Justice Department officials say LockBit never deleted its victim data, regardless of whether those organizations paid a ransom to keep the information from being published on LockBit&#8217;s victim shaming website.<span id="more-67380"></span></p>
<p>Khoroshev is the sixth person officially indicted as active members of LockBit. The government says Russian national <strong>Artur Sungatov</strong> used LockBit ransomware against victims in manufacturing, logistics, insurance and other companies throughout the United States.</p>
<p><strong>Ivan Gennadievich Kondratyev</strong>, a.k.a. “Bassterlord,” allegedly deployed LockBit against targets in the United States, Singapore, Taiwan, and Lebanon. Kondratyev is also <a href="media/2323b5ec.vasiliev.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/vasiliev.pdf" target="_blank" rel="noopener">charged</a> (PDF) with three criminal counts arising from his alleged use of the Sodinokibi (aka “<a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">REvil</a>“) ransomware variant to encrypt data, exfiltrate victim information, and extort a ransom payment from a corporate victim based in Alameda County, California.</p>
<p>In May 2023, U.S. authorities unsealed indictments against two alleged LockBit affiliates, <strong>Mikhail “Wazawaka” Matveev</strong> and <strong>Mikhail Vasiliev</strong>. In January 2022, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">Who is the Network Access Broker ‘Wazawaka,’</a> which followed clues from Wazawaka’s many pseudonyms and contact details on the Russian-language cybercrime forums back to a 31-year-old Mikhail Matveev from Abaza, RU.</p>
<p>Matveev remains at large, presumably still in Russia. Meanwhile, the U.S. Department of State has <a href="http://www.tips.fbi.gov/" target="_blank" rel="noopener">a standing $10 million reward offer</a> for information leading to Matveev&#8217;s arrest.</p>
<p>Vasiliev, 35, of Bradford, Ontario, Canada, is in custody in Canada awaiting extradition to the United States (the complaint against Vasiliev is at <a href="media/2323b5ec.vasiliev.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/vasiliev.pdf" target="_blank" rel="noopener">this PDF</a>).</p>
<p>In June 2023, Russian national <strong>Ruslan Magomedovich Astamirov</strong> was charged in New Jersey for his participation in the LockBit conspiracy, including the deployment of LockBit against victims in Florida, Japan, France, and Kenya. Astamirov is currently in custody in the United States awaiting trial.</p>
<p>The Justice Department is urging victims targeted by LockBit to contact the FBI at <a class="ext" href="https://lockbitvictims.ic3.gov/" target="_blank" rel="noopener" data-extlink="">https://lockbitvictims.ic3.gov/</a> to file an official complaint, and to determine whether affected systems can be successfully decrypted.</p>


feed_id: https://krebsonsecurity.com/?p=67396
title: How Did Authorities Identify the Alleged Lockbit Boss?
uri: How-Did-Authorities-Identify-the-Alleged-Lockbit-Boss
url: https://krebsonsecurity.com/2024/05/how-did-authorities-identify-the-alleged-lockbit-boss/
content:
<p>Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named <strong>Dmitry Yuryevich Khoroshev</strong> as the leader of the infamous <strong>LockBit</strong> ransomware group. LockBit&#8217;s leader &#8220;<strong>LockBitSupp</strong>&#8221; claims the feds named the wrong guy, saying the charges don&#8217;t explain how they connected him to Khoroshev. This post examines the activities of Khoroshev&#8217;s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years.</p>
<div id="attachment_67453" style="width: 260px" class="wp-caption alignright"><img aria-describedby="caption-attachment-67453" decoding="async" class=" wp-image-67453" src="media/3b3e19de.khoroshev-sq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/khoroshev-sq.png" alt="" width="250" height="255" /><p id="caption-attachment-67453" class="wp-caption-text">Dmitry Yuryevich Khoroshev. Image: treasury.gov.</p></div>
<p>On May 7, the U.S. Department of Justice <a href="https://www.justice.gov/opa/media/1350921/dl?inline" target="_blank" rel="noopener">indicted</a> Khoroshev on 26 criminal counts, including extortion, wire fraud, and conspiracy. The government alleges Khoroshev created, sold and used the LockBit ransomware strain to personally extort more than $100 million from hundreds of victim organizations, and that LockBit as a group extorted roughly half a billion dollars over four years.</p>
<p>Federal investigators say Khoroshev ran LockBit as a &#8220;<strong>ransomware-as-a-service</strong>&#8221; operation, wherein he kept 20 percent of any ransom amount paid by a victim organization infected with his code, with the remaining 80 percent of the payment going to LockBit affiliates responsible for spreading the malware.</p>
<p>Financial <a href="https://ofac.treasury.gov/recent-actions/20240507" target="_blank" rel="noopener">sanctions levied against Khoroshev</a> by the <strong>U.S. Department of the Treasury</strong> listed his known email and street address (in Voronezh, in southwest Russia), passport number, and even his tax ID number (hello, Russian tax authorities). The Treasury filing says Khoroshev used the emails <strong>sitedev5@yandex.ru</strong>, and <strong>khoroshev1@icloud.com</strong>.</p>
<p>According to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a>, the address sitedev5@yandex.ru was used to register at least six domains, including a Russian business registered in Khoroshev&#8217;s name called <strong>tkaner.com</strong>, which is a blog about clothing and fabrics.</p>
<p>A search at the breach-tracking service <a href="https://constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> on the phone number in Tkaner&#8217;s registration records  &#8212; <strong>7.9521020220</strong> &#8212; brings up multiple official Russian government documents listing the number&#8217;s owner as Dmitri Yurievich Khoroshev.</p>
<p>Another domain registered to that phone number was <strong>stairwell[.]ru</strong>, which at one point advertised the sale of wooden staircases. Constella finds that the email addresses webmaster@stairwell.ru and admin@stairwell.ru used the password <strong>225948</strong>.</p>
<p>DomainTools reports that stairwell.ru for several years included the registrant&#8217;s name as &#8220;<strong>Dmitrij Ju Horoshev</strong>,&#8221; and the email address <strong>pin@darktower.su</strong>. According to Constella, this email address was used in 2010 to register an account for a Dmitry Yurievich Khoroshev from Voronezh, Russia at the hosting provider <strong>firstvds.ru</strong>.</p>
<div id="attachment_67416" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67416" decoding="async" loading="lazy" class=" wp-image-67416" src="media/75ab8530.voronezh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/voronezh.png" alt="" width="750" height="499" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/voronezh.png 800w, https://krebsonsecurity.com/wp-content/uploads/2024/05/voronezh-768x511.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/voronezh-782x520.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67416" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> finds that pin@darktower.ru was used by a Russian-speaking member called Pin on the English-language cybercrime forum <b>Opensc. </b>Pin was active on Opensc around March 2012, and authored 13 posts that mostly concerned data encryption issues, or how to fix bugs in code.</p>
<p>Other posts concerned custom code Pin claimed to have written that would bypass memory protections on Windows XP and Windows 7 systems, and inject malware into memory space normally allocated to trusted applications on a Windows machine.</p>
<p>Pin also was active at that same time on the Russian-language security forum <b>Antichat</b>, where they told fellow forum members to contact them at the ICQ instant messenger number <strong>669316</strong>.</p>
<h2>NEROWOLFE</h2>
<p>A search on the ICQ number 669316 at Intel 471 shows that in April 2011, a user by the name <strong>NeroWolfe</strong> joined the Russian cybercrime forum <strong>Zloy</strong> using the email address <strong>d.horoshev@gmail.com</strong>, and from an Internet address in Voronezh, RU.</p>
<p>Constella finds the same password tied to webmaster@stairwell.ru (225948) was used by the email address <strong>3k@xakep.ru</strong>, which Intel 471 says was registered to more than a dozen NeroWolfe accounts across just as many Russian cybercrime forums between 2011 and 2015.</p>
<p>NeroWolfe&#8217;s introductory post to the forum <strong>Verified</strong> in Oct. 2011 said he was a system administrator and C++ coder.</p>
<p>&#8220;Installing SpyEYE, ZeuS, any DDoS and spam admin panels,&#8221; NeroWolfe wrote. This user said they specialize in developing malware, creating computer worms, and crafting new ways to hijack Web browsers.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="750" height="562" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>&#8220;I can provide my portfolio on request,&#8221; NeroWolfe wrote. &#8220;P.S. I don&#8217;t modify someone else&#8217;s code or work with someone else&#8217;s frameworks.&#8221;</p>
<p>In April 2013, NeroWolfe wrote in a private message to another Verified forum user that he was selling a malware &#8220;loader&#8221; program that could bypass all of the security protections on Windows XP and Windows 7.</p>
<p>&#8220;The access to the network is slightly restricted,&#8221; NeroWolfe said of the loader, which he was selling for $5,000. &#8220;You won&#8217;t manage to bind a port. However, it&#8217;s quite possible to send data. The code is written in C.&#8221;</p>
<p>In an October 2013 discussion on the cybercrime forum <strong>Exploit</strong>, NeroWolfe weighed in on the karmic ramifications of ransomware. At the time, ransomware-as-a-service didn&#8217;t exist yet, and many members of Exploit were still making good money from &#8220;lockers,&#8221; relatively crude programs that locked the user out of their system until they agreed to make a small payment (usually a few hundred dollars via prepaid Green Dot cards).</p>
<p>Lockers, which presaged the coming ransomware scourge, were generally viewed by the Russian-speaking cybercrime forums as harmless moneymaking opportunities, because they usually didn&#8217;t seek to harm the host computer or endanger files on the system. Also, there were still plenty of locker programs that aspiring cybercriminals could either buy or rent to make a steady income.</p>
<p>NeroWolfe reminded forum denizens that they were just as vulnerable to ransomware attacks as their would-be victims, and that what goes around comes around.</p>
<p>&#8220;Guys, do you have a conscience?,&#8221; NeroWolfe wrote. &#8220;Okay, lockers, network gopstop aka business in Russian. The last thing was always squeezed out of the suckers. But encoders, no one is protected from them, including the local audience.&#8221;<span id="more-67396"></span></p>
<p>If Khoroshev was ever worried that someone outside of Russia might be able to connect his early hacker handles to his real life persona, that&#8217;s not clear from reviewing his history online. In fact, the same email address tied to so many of NeroWolfe&#8217;s accounts on the forums &#8212; 3k@xakep.ru &#8212; was used in 2011 to create an account for a Dmitry Yurevich Khoroshev on the Russian social media network <strong>Vkontakte</strong>.</p>
<p>NeroWolfe seems to have abandoned all of his forum accounts sometime in 2016. In November 2016, an exploit[.]ru member filed an official complaint against NeroWolfe, saying NeroWolfe had been paid $2,000 to produce custom code but never finished the project and vanished.</p>
<p>It&#8217;s unclear what happened to NeroWolfe or to Khoroshev during this time. Maybe he got arrested, or some close associates did. Perhaps he just decided it was time to lay low and hit the reset on his operational security efforts, given his past failures in this regard. It&#8217;s also possible NeroWolfe landed a real job somewhere for a few years, fathered a child, and/or had to put his cybercrime career on hold.</p>
<h2>PUTINKRAB</h2>
<p>Or perhaps Khoroshev saw the coming ransomware industry for the endless pot of gold that it was about to become, and then dedicated himself to working on custom ransomware code. That&#8217;s what the government believes.</p>
<p>The indictment against Khoroshev says he used the hacker nickname <strong>Putinkrab</strong>, and Intel 471 says this corresponds to a username that was first registered across three major Russian cybercrime forums in early 2019.</p>
<p>KrebsOnSecurity could find no obvious connections between Putinkrab and any of Khoroshev&#8217;s older identities. However, if Putinkrab was Khoroshev, he would have learned from his past mistakes and started fresh with a new identity (which he did). But also, it is likely the government hasn&#8217;t shared all of the intelligence it has collected against him (more on that in a bit).</p>
<p>Putinkrab&#8217;s first posts on the Russian cybercrime forums XSS, Exploit and UFOLabs saw this user selling ransomware source code written in C.</p>
<div id="attachment_67402" style="width: 795px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67402" decoding="async" loading="lazy" class="size-full wp-image-67402" src="media/ae4082ae.putinkrab-ufo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/putinkrab-ufo.png" alt="" width="785" height="849" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/putinkrab-ufo.png 785w, https://krebsonsecurity.com/wp-content/uploads/2024/05/putinkrab-ufo-768x831.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/putinkrab-ufo-782x846.png 782w" sizes="(max-width: 785px) 100vw, 785px" /><p id="caption-attachment-67402" class="wp-caption-text">A machine-translated ad for ransomware source code from Putinkrab on the Russian language cybercrime forum UFOlabs in 2019. Image: Ke-la.com.</p></div>
<p>In April 2019, Putkinkrab offered an affiliate program that would run on top of his custom-made ransomware code.</p>
<p>&#8220;I want to work for a share of the ransoms: 20/80,&#8221; Putinkrab wrote on Exploit. &#8220;20 percent is my percentage for the work, you get 80% of the ransoms. The percentage can be reduced up to 10/90 if the volumes are good. But now, temporarily, until the service is fully automated, we are working using a different algorithm.&#8221;</p>
<p>Throughout the summer of 2019, Putinkrab posted multiple updates to Exploit about new features being added to his ransomware strain, as well as novel evasion techniques to avoid detection by security tools. He also told forum members he was looking for investors for a new ransomware project based on his code.</p>
<p>In response to an Exploit member who complained that the security industry was making it harder to profit from ransomware, Putinkrab said that was because so many cybercriminals were relying on crappy ransomware code.</p>
<p>&#8220;The vast majority of top antiviruses have acquired behavioral analysis, which blocks 95% of crypto-lockers at their root,&#8221; Putinkrab wrote. &#8220;Cryptolockers made a lot of noise in the press, but lazy system administrators don’t make backups after that. The vast majority of cryptolockers are written by people who have little understanding of cryptography. Therefore, decryptors appear on the Internet, and with them the hope that files can be decrypted without paying a ransom. They just sit and wait. Contact with the owner of the key is lost over time.&#8221;</p>
<p>Putinkrab said he had every confidence his ransomware code was a game-changer, and a huge money machine.</p>
<p>&#8220;The game is just gaining momentum,&#8221; Putinkrab wrote. &#8220;Weak players lose and are eliminated.&#8221;</p>
<p>The rest of his response was structured like a poem:</p>
<blockquote><p>&#8220;In this world, the strongest survive.<br />
Our life is just a struggle.<br />
The winner will be the smartest,<br />
Who has his head on his shoulders.&#8221;</p></blockquote>
<p>Putinkrab&#8217;s final post came on August 23, 2019. The Justice Department says the LockBit ransomware affiliate program was officially launched five months later. From there on out, the government says, Khoroshev adopted the persona of LockBitSupp. In his introductory post on Exploit, LockBit&#8217;s mastermind said the ransomware strain had been in development since September 2019.</p>
<p>The original LockBit malware was written in C (a language that NeroWolfe excelled at). Here&#8217;s the original description of LockBit, from its maker:</p>
<blockquote><p>&#8220;The software is written in C and Assembler; encryption is performed through the I/O Completion Port; there is a port scanning local networks and an option to find all DFS, SMB, WebDAV network shares, an admin panel in Tor, automatic test decryption; a decryption tool is provided; there is a chat with Push notifications, a Jabber bot that forwards correspondence and an option to terminate services/processes in line which prevent the ransomware from opening files at a certain moment. The ransomware sets file permissions and removes blocking attributes, deletes shadow copies, clears logs and mounts hidden partitions; there is an option to drag-and-drop files/folders and a console/hidden mode. The ransomware encrypts files in parts in various places: the larger the file size, the more parts there are. The algorithms used are AES + RSA.</p>
<p>You are the one who determines the ransom amount after communicating with the victim. The ransom paid in any currency that suits you will be transferred to your wallets. The Jabber bot serves as an admin panel and is used for banning, providing decryption tools, chatting &#8211; Jabber is used for absolutely everything.&#8221;</p></blockquote>
<h2>CONCLUSION</h2>
<p>Does the above timeline prove that NeroWolfe/Khoroshev is LockBitSupp? No. However, it does indicate Khoroshev was for many years deeply invested in countless schemes involving botnets, stolen data, and malware he wrote that others used to great effect. NeroWolfe&#8217;s many private messages from fellow forum members confirm this.</p>
<p>NeroWolfe&#8217;s specialty was creating custom code that employed novel stealth and evasion techniques, and he was always quick to volunteer his services on the forums whenever anyone was looking help on a malware project that called for a strong C or C++ programmer.</p>
<p>Someone with those qualifications &#8212; as well as demonstrated mastery of data encryption and decryption techniques &#8212; would have been in great demand by the ransomware-as-a-service industry that took off at around the same time NeroWolfe vanished from the forums.</p>
<p>Someone like that who is near or at the top of their game vis-a-vis their peers does not simply walk away from that level of influence, community status, and potential income stream unless forced to do so by circumstances beyond their immediate control.</p>
<p>It&#8217;s important to note that Putinkrab didn&#8217;t just materialize out of thin air in 2019 &#8212; suddenly endowed with knowledge about how to write advanced, stealthy ransomware strains. That knowledge clearly came from someone who&#8217;d already had years of experience building and deploying ransomware strains against real-life victim organizations.</p>
<p>Thus, whoever Putinkrab was before they adopted that moniker, it&#8217;s a safe bet they were involved in the development and use of earlier, highly successful ransomware strains. One strong possible candidate is <a href="https://blog.malwarebytes.com/detections/ransom-cerber/" target="_blank" rel="noopener noreferrer">Cerber ransomware</a>, the most popular and effective affiliate program operating between early 2016 and mid-2017. Cerber thrived because it emerged as an early mover in the market for ransomware-as-a-service offerings.</p>
<p>In February 2024, <a href="https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/" target="_blank" rel="noopener">the FBI seized LockBit&#8217;s cybercrime infrastructure on the dark web</a>, following an apparently lengthy infiltration of the group&#8217;s operations. The United States has already indicted and sanctioned at least five other alleged LockBit ringleaders or affiliates, so presumably the feds have been able to draw additional resources from those investigations.</p>
<p>Also, it seems likely that the three national intelligence agencies involved in bringing these charges are not showing all of their cards. For example, the Treasury documents on Khoroshev mention a single cryptocurrency address, and yet experts interviewed for this story say there are no obvious clues connecting this address to Khoroshev or Putinkrab.</p>
<p>But given that LockBitSupp has been actively involved in Lockbit ransomware attacks against organizations for four years now, the government almost certainly has an extensive list of the LockBit leader&#8217;s various cryptocurrency addresses &#8212; and probably even his bank accounts in Russia. And no doubt the money trail from some of those transactions was traceable to its ultimate beneficiary (or close enough).</p>
<p>Not long after Khoroshev was charged as the leader of LockBit, a number of open-source intelligence accounts on Telegram began extending the information released by the Treasury Department. Within hours, these sleuths had unearthed more than a dozen credit card accounts used by Khoroshev over the past decade, as well as his various bank account numbers in Russia.</p>
<p>The point is, this post is based on data that&#8217;s available to and verifiable by KrebsOnSecurity. Woodward &amp; Bernstein&#8217;s source in the Watergate investigation &#8212; Deep Throat &#8212; famously told the two reporters to &#8220;follow the money.&#8221; This is always excellent advice. But these days, that can be a lot easier said than done &#8212; especially with people who a) do not wish to be found, and b) don&#8217;t exactly file annual reports.</p>


feed_id: https://krebsonsecurity.com/?p=67337
title: Patch Tuesday, May 2024 Edition
uri: Patch-Tuesday-May-2024-Edition
url: https://krebsonsecurity.com/2024/05/patch-tuesday-may-2024-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix more than 60 security holes in <strong>Windows</strong> computers and supported software, including two &#8220;zero-day&#8221; vulnerabilities in Windows that are already being exploited in active attacks. There are also important security patches available for <strong>macOS</strong> and <strong>Adobe</strong> users, and for the <strong>Chrome</strong> Web browser, which just patched its own zero-day flaw.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>First, the zero-days. <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30051" target="_blank" rel="noopener">CVE-2024-30051</a> is an &#8220;elevation of privilege&#8221; bug in a core Windows library. <strong>Satnam Narang</strong> at <strong>Tenable</strong> said this flaw is being used as part of post-compromise activity to elevate privileges as a local attacker.</p>
<p>&#8220;CVE-2024-30051 is used to gain initial access into a target environment and requires the use of social engineering tactics via email, social media or instant messaging to convince a target to open a specially crafted document file,&#8221; Narang said. &#8220;Once exploited, the attacker can bypass OLE mitigations in Microsoft 365 and Microsoft Office, which are security features designed to protect end users from malicious files.&#8221;</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30040" target="_blank" rel="noopener">CVE-2024-30040</a> is a security feature bypass in <strong>MSHTML</strong>, a component that is deeply tied to the default Web browser on Windows systems. Microsoft&#8217;s advisory on this flaw is fairly sparse, but <strong>Kevin Breen</strong> from <strong>Immersive Labs</strong> said this vulnerability also affects <strong>Office 365</strong> and <strong>Microsoft Office</strong> applications.</p>
<p>&#8220;Very little information is provided and the short description is painfully obtuse,&#8221; Breen said of Microsoft&#8217;s advisory on CVE-2024-30040.</p>
<p>Meanwhile, <strong>Kaspersky Lab</strong>, one of two companies credited with reporting exploitation of CVE-2024-30040 to Microsoft, has published <a href="https://securelist.com/cve-2024-30051/112618/" target="_blank" rel="noopener">a fascinating writeup</a> on how they discovered the exploit in a file shared with Virustotal.com.</p>
<p>Kaspersky said it has since seen the exploit used together with <a href="https://krebsonsecurity.com/2023/08/u-s-hacks-qakbot-quietly-removes-botnet-infections/" target="_blank" rel="noopener">QakBot</a> and other malware. Emerging in 2007 as a banking trojan, QakBot (a.k.a. <strong>Qbot</strong> and <strong>Pinkslipbot</strong>) has morphed into an advanced malware strain now used by multiple cybercriminal groups to prepare newly compromised networks for ransomware infestations.<span id="more-67337"></span></p>
<p>The only vulnerability fixed this month that earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30044" target="_blank" rel="noopener">CVE-2024-30044</a>, a flaw in <strong>Sharepoint</strong> that Microsoft said is likely to be exploited. Tenable&#8217;s Narang notes that exploitation of this bug requires an attacker to be authenticated to a vulnerable SharePoint Server with Site Owner permissions (or higher) first and to take additional steps in order to exploit this flaw, which makes this flaw less likely to be widely exploited as most attackers follow the path of least resistance.</p>
<p>Five days ago, Google <a href="https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html" target="_blank" rel="noopener">released a security update for Chrome</a> that fixes a zero-day in the popular browser. Chrome usually auto-downloads any available updates, but it still may require a complete restart of the browser to install them. If you use Chrome and see a &#8220;Relaunch to update&#8221; message in the upper right corner of the browser, it&#8217;s time to restart.</p>
<p>Apple has just shipped <a href="https://support.apple.com/en-us/HT214106" target="_blank" rel="noopener">macOS Sonoma 14.5 update</a>, which includes nearly two dozen security patches. To ensure your Mac is up-to-date, go to System Settings, General tab, then Software Update and follow any prompts.</p>
<p>Finally, Adobe has <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">critical security patches available</a> for a range of products, including <strong>Acrobat, Reader</strong>, <strong>Illustrator</strong>, <strong>Adobe Substance 3D Painter</strong>, <strong>Adobe Aero</strong>, <strong>Adobe Animate</strong> and <strong>Adobe Framemaker</strong>.</p>
<p>Regardless of whether you use a Mac or Windows system (or something else), it&#8217;s always a good idea to backup your data and or system before applying any security updates. For a closer look at the individual fixes released by Microsoft today, check out the complete list over at the <a href="https://isc.sans.edu/forums/diary/Microsoft%20May%202024%20Patch%20Tuesday/30920/" target="_blank" rel="noopener">SANS Internet Storm Center</a>. Anyone in charge of maintaining Windows systems in an enterprise environment should keep an eye on <a href="http://askwoody.com" target="_blank" rel="noopener">askwoody.com</a>, which usually has the scoop on any wonky Windows patches.</p>


feed_id: https://krebsonsecurity.com/?p=67551
title: Why Your Wi-Fi Router Doubles as an Apple AirTag
uri: Why-Your-Wi-Fi-Router-Doubles-as-an-Apple-AirTag
url: https://krebsonsecurity.com/2024/05/why-your-wi-fi-router-doubles-as-an-apple-airtag/
content:
<div id="attachment_67592" style="width: 813px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67592" decoding="async" class="size-full wp-image-67592" src="media/36f9d2d3.phoneloc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/phoneloc.png" alt="" width="803" height="563" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/phoneloc.png 803w, https://krebsonsecurity.com/wp-content/uploads/2024/05/phoneloc-768x538.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/phoneloc-782x548.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/05/phoneloc-100x70.png 100w" sizes="(max-width: 803px) 100vw, 803px" /><p id="caption-attachment-67592" class="wp-caption-text">Image: Shutterstock.</p></div>
<p><strong>Apple</strong> and the satellite-based broadband service <strong>Starlink</strong> each recently took steps to address new research into the potential security and privacy implications of how their services geo-locate devices. Researchers from the <strong>University of Maryland</strong> say they relied on publicly available data from Apple to track the location of billions of devices globally &#8212; including non-Apple devices like Starlink systems &#8212; and found they could use this data to monitor the destruction of Gaza, as well as the movements and in many cases identities of Russian and Ukrainian troops.</p>
<p>At issue is the way that Apple collects and publicly shares information about the precise location of all Wi-Fi access points seen by its devices. Apple collects this location data to give Apple devices a crowdsourced, low-power alternative to constantly requesting global positioning system (GPS) coordinates.</p>
<p>Both Apple and<strong> Google</strong> operate their own <strong>Wi-Fi-based Positioning Systems</strong> (WPS) that obtain certain hardware identifiers from all wireless access points that come within range of their mobile devices. Both record the <strong>Media Access Control</strong> (MAC) address that a Wi-FI access point uses, known as a <strong>Basic Service Set Identifier</strong> or <strong>BSSID</strong>.</p>
<p>Periodically, Apple and Google mobile devices will forward their locations &#8212; by querying GPS and/or by using cellular towers as landmarks &#8212; along with any nearby BSSIDs. This combination of data allows Apple and Google devices to figure out where they are within a few feet or meters, and it&#8217;s what allows your mobile phone to continue displaying your planned route even when the device can&#8217;t get a fix on GPS.</p>
<p>With Google&#8217;s WPS, a wireless device submits a list of nearby Wi-Fi access point BSSIDs and their signal strengths &#8212; via an <a href="https://www.cloudflare.com/learning/security/api/what-is-an-api/" target="_blank" rel="noopener">application programming interface</a> (API) request to Google &#8212; whose WPS responds with the device&#8217;s computed position. Google&#8217;s WPS requires at least two BSSIDs to calculate a device&#8217;s approximate position.</p>
<p>Apple&#8217;s WPS also accepts a list of nearby BSSIDs, but instead of computing the device&#8217;s location based off the set of observed access points and their received signal strengths and then reporting that result to the user, Apple&#8217;s API <em>will return the geolocations of up to 400 hundred more BSSIDs that are nearby the one requested</em>. It then uses approximately eight of those BSSIDs to work out the user&#8217;s location based on known landmarks.</p>
<p>In essence, Google&#8217;s WPS computes the user&#8217;s location and shares it with the device. Apple&#8217;s WPS gives its devices a large enough amount of data about the location of known access points in the area that the devices can do that estimation on their own.</p>
<p>That&#8217;s according to two researchers at the University of Maryland, who theorized they could use the verbosity of Apple&#8217;s API to map the movement of individual devices into and out of virtually any defined area of the world. The UMD pair said they spent a month early in their research continuously querying the API, asking it for the location of more than a billion BSSIDs generated at random.</p>
<p>They learned that while only about three million of those randomly generated BSSIDs were known to Apple&#8217;s Wi-Fi geolocation API, <em>Apple also returned an additional 488 million BSSID locations already stored in its WPS from other lookups</em>.</p>
<p><strong>UMD Associate Professor David Levin</strong> and Ph.D student <strong>Erik Rye</strong> found they could mostly avoid requesting unallocated BSSIDs by consulting the list of BSSID ranges assigned to specific device manufacturers. <a href="https://standards-oui.ieee.org/" target="_blank" rel="noopener">That list</a> is maintained by the <strong>Institute of Electrical and Electronics Engineers</strong> (IEEE), which is also sponsoring <a href="https://sp2024.ieee-security.org/" target="_blank" rel="noopener">the privacy and security conference</a> where Rye is slated to present the UMD research later today.</p>
<p>Plotting the locations returned by Apple&#8217;s WPS between November 2022 and November 2023, Levin and Rye saw they had a near global view of the locations tied to more than two billion Wi-Fi access points. The map showed geolocated access points in nearly every corner of the globe, apart from almost the entirety of China, vast stretches of desert wilderness in central Australia and Africa, and deep in the rainforests of South America.</p>
<div id="attachment_67580" style="width: 759px" class="wp-caption aligncenter"><a href="media/2d49560b.bssidglobal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/bssidglobal.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67580" decoding="async" loading="lazy" class="wp-image-67580" src="media/2d49560b.bssidglobal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/bssidglobal.png" alt="" width="749" height="356" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/bssidglobal.png 907w, https://krebsonsecurity.com/wp-content/uploads/2024/05/bssidglobal-768x365.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/bssidglobal-782x372.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-67580" class="wp-caption-text">A &#8220;heatmap&#8221; of BSSIDs the UMD team said they discovered by guessing randomly at BSSIDs.</p></div>
<p>The researchers said that by zeroing in on or &#8220;geofencing&#8221; other smaller regions indexed by Apple&#8217;s location API, they could monitor how Wi-Fi access points moved over time. Why might that be a big deal? They found that by geofencing active conflict zones in Ukraine, they were able to determine the location and movement of Starlink devices used by both Ukrainian and Russian forces.</p>
<p>The reason they were able to do that is that each Starlink terminal &#8212; the dish and associated hardware that allows a Starlink customer to receive Internet service from a constellation of orbiting Starlink satellites &#8212; includes its own Wi-Fi access point, whose location is going to be automatically indexed by any nearby Apple devices that have location services enabled.</p>
<div id="attachment_67582" style="width: 761px" class="wp-caption aligncenter"><a href="media/b002eaef.heatmap-ua.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/heatmap-ua.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67582" decoding="async" loading="lazy" class="wp-image-67582" src="media/b002eaef.heatmap-ua.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/heatmap-ua.png" alt="" width="751" height="368" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/heatmap-ua.png 941w, https://krebsonsecurity.com/wp-content/uploads/2024/05/heatmap-ua-768x376.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/heatmap-ua-782x383.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-67582" class="wp-caption-text">A heatmap of Starlink routers in Ukraine. Image: UMD.</p></div>
<p>The University of Maryland team geo-fenced various conflict zones in Ukraine, and identified at least 3,722 Starlink terminals geolocated in Ukraine.</p>
<p>&#8220;We find what appear to be personal devices being brought by military personnel into war zones, exposing pre-deployment sites and military positions,&#8221; the researchers wrote. &#8220;Our results also show individuals who have left Ukraine to a wide range of countries, validating public reports of where Ukrainian refugees have resettled.&#8221;</p>
<p>In an interview with KrebsOnSecurity, the UMD team said they found that in addition to exposing Russian troop pre-deployment sites, the location data made it easy to see where devices in contested regions originated from.</p>
<p>&#8220;This includes residential addresses throughout the world,&#8221; Levin said. &#8220;We even believe we can identify people who have joined the Ukraine Foreign Legion.&#8221;</p>
<div id="attachment_67576" style="width: 755px" class="wp-caption aligncenter"><a href="media/4fe29d63.starlinkbssideur.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/starlinkbssideur.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67576" decoding="async" loading="lazy" class="wp-image-67576" src="media/4fe29d63.starlinkbssideur.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/starlinkbssideur.png" alt="" width="745" height="459" /></a><p id="caption-attachment-67576" class="wp-caption-text">A simplified map of where BSSIDs that enter the Donbas and Crimea regions of Ukraine originate. Image: UMD.</p></div>
<p>Levin and Rye said they shared their findings with Starlink in March 2024, and that Starlink told them the company began shipping software updates in 2023 that force Starlink access points to randomize their BSSIDs.<span id="more-67551"></span></p>
<p>Starlink&#8217;s parent SpaceX did not respond to requests for comment. But the researchers shared a graphic they said was created from their Starlink BSSID monitoring data, which shows that just in the past month there was a substantial drop in the number of Starlink devices that were geo-locatable using Apple&#8217;s API.</p>
<div id="attachment_67587" style="width: 760px" class="wp-caption aligncenter"><a href="media/0868fee0.geolocated-starlink-bssids.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/geolocated-starlink-bssids.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67587" decoding="async" loading="lazy" class="wp-image-67587" src="media/0868fee0.geolocated-starlink-bssids.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/geolocated-starlink-bssids.png" alt="" width="750" height="463" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/geolocated-starlink-bssids.png 1218w, https://krebsonsecurity.com/wp-content/uploads/2024/05/geolocated-starlink-bssids-768x474.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/geolocated-starlink-bssids-782x482.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-67587" class="wp-caption-text">UMD researchers shared this graphic, which shows their ability to monitor the location and movement of Starlink devices by BSSID dropped precipitously in the past month.</p></div>
<p>They also shared a written statement they received from Starlink, which acknowledged that Starlink User Terminal routers originally used a static BSSID/MAC:</p>
<blockquote><p>&#8220;In early 2023 a software update was released that randomized the main router BSSID. Subsequent software releases have included randomization of the BSSID of WiFi repeaters associated with the main router. Software updates that include the repeater randomization functionality are currently being deployed fleet-wide on a region-by-region basis. We believe the data outlined in your paper is based on Starlink main routers and or repeaters that were queried prior to receiving these randomization updates.&#8221;</p></blockquote>
<p>The researchers also focused their geofencing on the Israel-Hamas war in Gaza, and were able to track the migration and disappearance of devices throughout the Gaza Strip as Israeli forces cut power to the country and bombing campaigns knocked out key infrastructure.</p>
<p>&#8220;As time progressed, the number of Gazan BSSIDs that are geolocatable continued to decline,&#8221; they wrote. &#8220;By the end of the month, only 28% of the original BSSIDs were still found in the Apple WPS.&#8221;</p>
<p>Apple did not respond to requests for comment. But in late March 2024, Apple <a href="https://web.archive.org/web/20240328071851/https://support.apple.com/en-us/102515" target="_blank" rel="noopener">quietly tweaked its privacy policy</a>, allowing people to opt out of having the location of their wireless access points collected and shared by Apple &#8212; by appending &#8220;_nomap&#8221; to the end of the Wi-Fi access point&#8217;s name (SSID). Adding &#8220;_nomap&#8221; to your Wi-Fi network name <a href="https://support.google.com/maps/answer/1725632?hl=en#zippy=%2Chow-do-i-opt-my-access-point-out-of-google-location-services" target="_blank" rel="noopener">also blocks Google from indexing its location</a>.</p>
<div id="attachment_67574" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67574" decoding="async" loading="lazy" class=" wp-image-67574" src="media/28b3efcf.apple-bssids.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/apple-bssids.png" alt="" width="749" height="374" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/apple-bssids.png 841w, https://krebsonsecurity.com/wp-content/uploads/2024/05/apple-bssids-768x384.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/apple-bssids-782x391.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-67574" class="wp-caption-text">Apple updated its privacy and location services policy in March 2024 to allow people to opt out of having their Wi-Fi access point indexed by its service, by appending &#8220;_nomap&#8221; to the network&#8217;s name.</p></div>
<p>Rye said Apple&#8217;s response addressed the most depressing aspect of their research: That there was previously no way for anyone to opt out of this data collection.</p>
<p>&#8220;You may not have Apple products, but if you have an access point and someone near you owns an Apple device, your BSSID will be in [Apple&#8217;s] database,&#8221; he said. &#8220;What&#8217;s important to note here is that every access point is being tracked, without opting in, whether they run an Apple device or not. Only after we disclosed this to Apple have they added the ability for people to opt out.&#8221;</p>
<p>The researchers said they hope Apple will consider additional safeguards, such as proactive ways to limit abuses of its location API.</p>
<p>&#8220;It&#8217;s a good first step,&#8221; Levin said of Apple&#8217;s privacy update in March. &#8220;But this data represents a really serious privacy vulnerability. I would hope Apple would put further restrictions on the use of its API, like rate-limiting these queries to keep people from accumulating massive amounts of data like we did.&#8221;</p>
<p>The UMD researchers said they omitted certain details from their study to protect the users they were able to track, noting that the methods they used could present risks for those fleeing abusive relationships or stalkers.</p>
<p>&#8220;We observe routers move between cities and countries, potentially representing their owner’s relocation or a business transaction between an old and new owner,&#8221; they wrote. &#8220;While there is not necessarily a 1-to-1 relationship between Wi-Fi routers and users, home routers typically only have several. If these users are vulnerable populations, such as those fleeing intimate partner violence or a stalker, their router simply being online can disclose their new location.&#8221;</p>
<p>The researchers said Wi-Fi access points that can be created using a mobile device&#8217;s built-in cellular modem do not create a location privacy risk for their users because mobile phone hotspots will choose a random BSSID when activated.</p>
<p>&#8220;Modern Android and iOS devices will choose a random BSSID when you go into hotspot mode,&#8221; he said. &#8220;Hotspots are already implementing the strongest recommendations for privacy protections. It&#8217;s other types of devices that don&#8217;t do that.&#8221;</p>
<p>For example, they discovered that certain commonly used travel routers compound the potential privacy risks.</p>
<p>&#8220;Because travel routers are frequently used on campers or boats, we see a significant number of them move between campgrounds, RV parks, and marinas,&#8221; the UMD duo wrote. &#8220;They are used by vacationers who move between residential dwellings and hotels. We have evidence of their use by military members as they deploy from their homes and bases to war zones.&#8221;</p>
<p>A copy of the UMD research is available <a href="media/613cce8d.wifi-surveillance-sp24.pdf" data-original-source="https://www.cs.umd.edu/~dml/papers/wifi-surveillance-sp24.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=66304
title: Stark Industries Solutions: An Iron Hammer in the Cloud
uri: Stark-Industries-Solutions-An-Iron-Hammer-in-the-Cloud
url: https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/
content:
<div id="attachment_67471" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67471" decoding="async" class=" wp-image-67471" src="media/f5a3db0f.stark-industries-solutions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions.png" alt="" width="751" height="466" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions.png 1197w, https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions-768x477.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions-782x485.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-67471" class="wp-caption-text">The homepage of Stark Industries Solutions.</p></div>
<p>Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called <strong>Stark Industries Solutions</strong> materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government and commercial targets in Ukraine and Europe. An investigation into Stark Industries reveals it is being used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia.</p>
<p>At least a dozen patriotic Russian hacking groups have been launching DDoS attacks since the start of the war at a variety of targets seen as opposed to Moscow. But by all accounts, few attacks from those gangs have come close to the amount of firepower wielded by a pro-Russia group calling itself &#8220;<strong>NoName057(16)</strong>.&#8221;</p>
<div id="attachment_67469" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67469" decoding="async" loading="lazy" class=" wp-image-67469" src="media/47de455e.netscout-hacktivist-ddos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/netscout-hacktivist-ddos.png" alt="" width="751" height="442" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/netscout-hacktivist-ddos.png 996w, https://krebsonsecurity.com/wp-content/uploads/2024/05/netscout-hacktivist-ddos-768x452.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/netscout-hacktivist-ddos-782x460.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-67469" class="wp-caption-text">This graphic comes from a recent report from Arbor NETSCOUT about DDoS attacks from Russian hacktivist groups.</p></div>
<p>As detailed by researchers at <a href="https://www.radware.com/security/threat-advisories-and-attack-reports/hacktivism-unveiled-april-2023/" target="_blank" rel="noopener">Radware</a>, NoName has effectively gamified DDoS attacks, <a href="https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/" target="_blank" rel="noopener">recruiting hacktivists</a> via its Telegram channel and offering to pay people who agree to install a piece of software called <strong>DDoSia</strong>. That program allows NoName to commandeer the host computers and their Internet connections in coordinated DDoS campaigns, and DDoSia users with the most attacks can win cash prizes.</p>
<div id="attachment_67570" style="width: 511px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67570" decoding="async" loading="lazy" class="size-full wp-image-67570" src="media/ca63bea4.noname-nygreetings.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/noname-nygreetings.png" alt="" width="501" height="421" /><p id="caption-attachment-67570" class="wp-caption-text">The NoName DDoS group advertising on Telegram. Image: SentinelOne.com.</p></div>
<p>A <a href="https://www.team-cymru.com/post/a-blog-with-noname" target="_blank" rel="noopener">report</a> from the security firm <strong>Team Cymru</strong> found the DDoS attack infrastructure used in NoName campaigns is assigned to two interlinked hosting providers: <strong>MIRhosting</strong> and <strong>Stark Industries</strong>. MIRhosting is a hosting provider founded in The Netherlands in 2004. But <a href="https://bgp.he.net/AS44477" target="_blank" rel="noopener">Stark Industries Solutions Ltd</a> was incorporated on February 10, 2022, just two weeks before the Russian invasion of Ukraine.</p>
<h2>PROXY WARS</h2>
<p>Security experts say that not long after the war started, Stark began hosting dozens of proxy services and free virtual private networking (VPN) services, which are designed to help users shield their Internet usage and location from prying eyes.</p>
<p>Proxy providers allow users to route their Internet and Web browsing traffic through someone else&#8217;s computer. From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-31323" src="media/2591b79f.proxy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png" alt="" width="600" height="251" /></p>
<p>These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are also massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source.</p>
<p>What&#8217;s more, many proxy services do not disclose how they obtain access to the proxies they are renting out, and in many cases the access is obtained through the dissemination of malicious software that turns the infected system in a traffic relay &#8212; usually unbeknownst to the legitimate owner of the Internet connection. Other proxy services will allow users to make money by renting out their Internet connection to anyone.</p>
<p><a href="https://spur.us" target="_blank" rel="noopener">Spur.us</a> is a company that tracks VPNs and proxy services worldwide. Spur finds that Stark Industries (AS44477) currently is home to at least 74 VPN services, and 40 different proxy services. As we&#8217;ll see in the final section of this story, just one of those proxy networks has over a million Internet addresses  available for rent across the globe.</p>
<p><strong>Raymond Dijkxhoorn</strong> operates a hosting firm in The Netherlands called <a href="https://www.prolocation.net" target="_blank" rel="noopener">Prolocation</a>. He also co-runs <a href="https://www.surbl.org/" target="_blank" rel="noopener">SURBL</a>, an anti-abuse service that flags domains and Internet address ranges that are strongly associated with spam and cybercrime activity, including DDoS.</p>
<p>Dijkxhoorn said last year SURBL heard from multiple people who said they operated VPN services whose web resources were included in SURBL&#8217;s block lists.</p>
<p>&#8220;We had people doing delistings at SURBL for domain names that were suspended by the registrars,&#8221; Dijkhoorn told KrebsOnSecurity. &#8220;And at least two of them explained that Stark offered them free VPN services that they were reselling.&#8221;</p>
<p>Dijkxhoorn added that Stark Industries also sponsored activist groups from Ukraine.</p>
<p>&#8220;How valuable would it be for Russia to know the real IPs from Ukraine&#8217;s tech warriors?&#8221; he observed.<span id="more-66304"></span></p>
<h2>CLOUDY WITH A CHANCE OF BULLETS</h2>
<p><strong>Richard Hummel </strong>is threat intelligence lead at <strong>Arbor NETSCOUT</strong>. Hummel said when he considers the worst of all the hosting providers out there today, Stark Industries is consistently near or at the top of that list.</p>
<p>&#8220;The reason is we&#8217;ve had at least a dozen service providers come to us saying, &#8216;There&#8217;s this network out there inundating us with traffic,'&#8221; Hummel said. &#8220;And it wasn&#8217;t even DDoS attacks. [The systems] on Stark were just scanning these providers so fast it was crashing some of their services.&#8221;</p>
<p>Hummel said NoName will typically launch their attacks using a mix of resources from rented from major, legitimate cloud services, and those from so-called &#8220;<strong>bulletproof</strong>&#8221; hosting providers like Stark. Bulletproof providers are so named when they earn or cultivate a reputation for ignoring any abuse complaints or police reports about activity on their networks.</p>
<p>Combining bulletproof providers with legitimate cloud hosting, Hummel said, likely makes NoName&#8217;s DDoS campaigns more resilient because many network operators will hesitate to be too aggressive in blocking Internet addresses associated with the major cloud services.</p>
<p>&#8220;What we typically see here is a distribution of cloud hosting providers and bulletproof hosting providers in DDoS attacks,&#8221; he said. &#8220;They&#8217;re using public cloud hosting providers because a lot of times that&#8217;s your first layer of network defense, and because [many companies are wary of] over-blocking access to legitimate cloud resources.&#8221;</p>
<p>But even if the cloud provider detects abuse coming from the customer, the provider is probably not going to shut the customer down immediately, Hummel said.</p>
<p>&#8220;There is usually a grace period, and even if that&#8217;s only an hour or two, you can still launch a large number of attacks in that time,&#8221; he said. &#8220;And then they just keep coming back and opening new cloud accounts.&#8221;</p>
<h2>MERCENARIES TEAM</h2>
<p>Stark Industries is incorporated at a mail drop address in the United Kingdom. UK business records list an <strong>Ivan Vladimirovich Neculiti</strong> as the company&#8217;s secretary. Mr. Neculiti also is named as the CEO and founder of <strong>PQ Hosting Plus S.R.L.</strong> (aka Perfect Quality Hosting), a Moldovan company formed in 2019 that lists the same UK mail drop address as Stark Industries.</p>
<div id="attachment_67530" style="width: 217px" class="wp-caption alignright"><img aria-describedby="caption-attachment-67530" decoding="async" loading="lazy" class=" wp-image-67530" src="media/d378456f.IVAN-N-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/IVAN-N-li.png" alt="" width="207" height="191" /><p id="caption-attachment-67530" class="wp-caption-text">Ivan Neculiti, as pictured on LinkedIn.</p></div>
<p>Reached via LinkedIn, Mr. Neculiti said PQ Hosting established Stark Industries as a &#8220;white label&#8221; of its brand so that &#8220;resellers could distribute our services using our IP addresses and their clients would not have any affairs with PQ Hosting.&#8221;</p>
<p>&#8220;PQ Hosting is a company with over 1,000+ of [our] own physical servers in 38 countries and we have over 100,000 clients,&#8221; he said. &#8220;Though we are not as large as Hetzner, Amazon and OVH, nevertheless we are a fast growing company that provides services to tens of thousands of private customers and legal entities.&#8221;</p>
<p>Asked about the constant stream of DDoS attacks whose origins have traced back to Stark Industries over the past two years, Neculiti maintained Stark hasn&#8217;t received any official abuse reports about attacks coming from its networks.</p>
<p>&#8220;It was probably some kind of clever attack that we did not see, I do not rule out this fact, because we have a very large number of clients and our Internet channels are quite large,&#8221; he said. &#8220;But, in this situation, unfortunately, no one contacted us to report that there was an attack from our addresses; if someone had contacted us, we would have definitely blocked the network data.&#8221;</p>
<p><a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> finds Ivan V. Neculiti was the owner of <strong>war[.]md</strong>, a website launched in 2008 that chronicled the history of a 1990 armed conflict in Moldova known as the <a href="https://en.wikipedia.org/wiki/Transnistria_War" target="_blank" rel="noopener">Transnistria War</a> and the Moldo-Russian war.</p>
<div id="attachment_67467" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67467" decoding="async" loading="lazy" class=" wp-image-67467" src="media/de9fb2d3.war-md.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/war-md.png" alt="" width="747" height="96" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/war-md.png 1167w, https://krebsonsecurity.com/wp-content/uploads/2024/05/war-md-768x99.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/war-md-782x101.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-67467" class="wp-caption-text">An ad for war.md, circa 2009.</p></div>
<p>Transnistria is a breakaway pro-Russian region that declared itself a state in 1990, although it is not internationally recognized. The copyright on that website credits the &#8220;<strong>MercenarieS TeaM</strong>,&#8221; which was at one time a Moldovan IT firm. Mr. Neculiti confirmed personally registering this domain.</p>
<h2>DON CHICHO &amp; DFYZ</h2>
<p>The data breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> reports that an Ivan V. Neculiti registered multiple online accounts under the email address <strong>dfyz_bk@bk.ru</strong>. Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> shows this email address is tied to the username &#8220;<strong>dfyz</strong>&#8221; on more than a half-dozen Russian language cybercrime forums since 2008. The user dfyz on Searchengines[.]ru in 2008 asked other forum members to review war.md, and said they were part of the MercenarieS TeaM.</p>
<p>Back then, dfyz was selling &#8220;bulletproof servers for any purpose,&#8221; meaning the hosting company would willfully ignore abuse complaints or police inquiries about the activity of its customers.</p>
<p>DomainTools reports there are at least 33 domain names registered to dfyz_bk@bk.ru. Several of these domains have Ivan Neculiti in their registration records, including tracker-free[.]cn, which was registered to an Ivan Neculiti at <a href="mailto:dfyz_bk@bk.ru" target="_blank" rel="noopener">dfyz_bk@bk.ru</a> and referenced the MercenarieS TeaM in its original registration records.</p>
<p>Dfyz also used the nickname <strong>DonChicho</strong>, who likewise sold bulletproof hosting services and access to hacked Internet servers. In 2014, a prominent member of the Russian language cybercrime community <strong>Antichat</strong> filed a complaint against DonChicho, saying this user scammed them and had used the email address dfyz_bk@bk.ru.</p>
<p>The complaint said DonChicho registered on Antichat from the Transnistria Internet address <strong>84.234.55[.]29</strong>. Searching this address in Constella reveals it has been used to register just five accounts online that have been created over the years, including one at ask.ru, where the user registered with the email address <strong>neculitzy1@yandex.ru</strong>. Constella also returns for that email address a user by the name &#8220;Ivan&#8221; at memoraleak.com and 000webhost.com.</p>
<p class="p1">Constella finds that the password most frequently used by the email address dfyz_bk@bk.ru was &#8220;<strong>filecast</strong>,&#8221; and that there are more than 90 email addresses associated with this password. Among them are roughly two dozen addresses with the name &#8220;Neculiti&#8221; in them, as well as the address <strong>support@donservers[.]ru</strong>.</p>
<p>Intel 471 says DonChicho posted to several Russian cybercrime forums that support@donservers[.]ru was his address, and that he logged into cybercrime forums almost exclusively from Internet addresses in <a href="https://en.wikipedia.org/wiki/Tiraspol" target="_blank" rel="noopener">Tiraspol</a>, the capital of <a href="https://en.wikipedia.org/wiki/Transnistria" target="_blank" rel="noopener">Transnistria</a>. A review of DonChicho&#8217;s posts shows this person was banned from several forums in 2014 for scamming other users.</p>
<p>Cached copies of DonChicho&#8217;s vanity domain (<a href="https://web.archive.org/web/20090925015758/http://donchicho.ru/" target="_blank" rel="noopener">donchicho[.]ru</a>) show that in 2009 he was a spammer who peddled knockoff prescription drugs via <a href="https://krebsonsecurity.com/tag/rx-promotion/" target="_blank" rel="noopener">Rx-Promotion</a>, once one of the largest pharmacy spam moneymaking programs for Russian-speaking affiliates.</p>
<p>Mr. Neculiti told KrebsOnSecurity he has never used the nickname DonChicho.</p>
<p>&#8220;I may assure you that I have no relation to DonChicho nor to his bulletproof servers,&#8221; he said.</p>
<p>Below is a mind map that shows the connections between the accounts mentioned above.</p>
<div id="attachment_67623" style="width: 761px" class="wp-caption aligncenter"><a href="media/990bad88.dfyz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67623" decoding="async" loading="lazy" class="wp-image-67623" src="media/990bad88.dfyz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz.png" alt="" width="751" height="482" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz.png 2800w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz-768x493.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz-1536x985.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz-2048x1314.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dfyz-782x502.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-67623" class="wp-caption-text">A mind map tracing the history of the user Dfyz. Click to enlarge.</p></div>
<p>Earlier this year, NoName began massively hitting government and industry websites in Moldova. A <a href="https://www.netscout.com/blog/asert/moldova-faces-wave-ddos-attacks" target="_blank" rel="noopener">new report</a> from <strong>Arbor Networks</strong> says the attacks began around March 6, when NoName alleged the government of Moldova was &#8220;craving for Russophobia.&#8221;</p>
<p>&#8220;Since early March, more than 50 websites have been targeted, according to posted &#8216;proof&#8217; by the groups involved in attacking the country,&#8221; Arbor&#8217;s <strong>ASERT Team</strong> <a href="https://www.netscout.com/blog/asert/moldova-faces-wave-ddos-attacks" target="_blank" rel="noopener">wrote</a>. &#8220;While NoName seemingly initiated the ramp of attacks, a host of other DDoS hacktivists have joined the fray in claiming credit for attacks across more than 15 industries.&#8221;</p>
<h2>CORRECTIV ACTION</h2>
<p>The German independent news outlet <strong>Correctiv.org</strong> last week published <a href="https://correctiv.org/faktencheck/russland-ukraine/2024/05/16/hacks-und-propaganda-zwei-brueder-aus-moldau-tragen-russlands-digitalen-krieg-nach-europa/" target="_blank" rel="noopener">a scathing investigative report on Stark Industries and MIRhosting</a>, which notes that Ivan Neculiti operates his hosting companies <a href="https://www.ripe.net/membership/indices/data/ru.zion5.html" target="_blank" rel="noopener">with the help of his brother, Yuri</a>.</p>
<div id="attachment_67519" style="width: 386px" class="wp-caption alignright"><a href="media/955baa3c.neculiti-netzwerk-768x1340-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/neculiti-netzwerk-768x1340-1.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67519" decoding="async" loading="lazy" class="wp-image-67519" src="media/955baa3c.neculiti-netzwerk-768x1340-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/neculiti-netzwerk-768x1340-1.png" alt="" width="376" height="656" /></a><p id="caption-attachment-67519" class="wp-caption-text">Image credit: correctiv.org.</p></div>
<p>The report points out that Stark Industries continues to host a Russian disinformation news outlet called &#8220;Recent Reliable News&#8221; (RRN) that was <a href="https://www.consilium.europa.eu/en/policies/sanctions-against-russia/timeline-sanctions-against-russia/#:~:text=On%2028%20July%2C%20the%20Council,support%20of%20Russia's%20war%20of" target="_blank" rel="noopener">sanctioned by the European Union in 2023</a> for spreading links to propaganda blogs and fake European media and government websites.</p>
<p>&#8220;The website was not running on computers in Moscow or St. Petersburg until recently, but in the middle of the EU, in the Netherlands, on the computers of the Neculiti brothers,&#8221; Correctiv reporters wrote.</p>
<p>&#8220;After a request from this editorial team, a well-known service was installed that hides the actual web host,&#8221; the report continues. &#8220;Ivan Neculiti announced that he had blocked the associated access and server following internal investigations. “We very much regret that we are only now finding out that one of our customers is a sanctioned portal,” said the company boss. However, RRN is still accessible via its servers.&#8221;</p>
<p>Correctiv also points to a January 2023 report from the Ukrainian government, which found servers from Stark Industries Solutions were used as part of a cyber attack on the Ukrainian news agency “<strong>Ukrinform</strong>”. Correctiv notes the notorious hacker group <a href="https://en.wikipedia.org/wiki/Sandworm_(hacker_group)" target="_blank" rel="noopener">Sandworm</a> &#8212; an advanced persistent threat (APT) group operated by a cyberwarfare unit of Russia&#8217;s military intelligence service &#8212; was <a href="https://cip.gov.ua/en/news/dlya-atak-na-ukrayinske-informagentstvo-rosiiski-khakeri-namagalisya-vikoristati-p-yat-shkidlivikh-program" target="_blank" rel="noopener">identified by Ukrainian government authorities</a> as responsible for that attack.</p>
<h2>PEACE HOSTING?</h2>
<p>Public records indicate MIRhosting is based in The Netherlands and is operated by 37-year old <strong>Andrey Nesterenko</strong>, whose <a href="https://web.archive.org/web/20040203144939/http://anesterenko.com:80/ru/bio.html" target="_blank" rel="noopener">personal website</a> says he is an accomplished concert pianist who began performing publicly at a young age.</p>
<p>DomainTools says mirhosting[.]com is registered to Mr. Nesterenko and to <strong>Innovation IT Solutions Corp</strong>, which lists addresses in London and in Nesterenko&#8217;s stated hometown of Nizhny Novgorod, Russia.</p>
<p>This is interesting because according to the book <em>Inside Cyber Warfare</em> by <strong>Jeffrey Carr</strong>, Innovation IT Solutions Corp. was responsible for hosting <strong>StopGeorgia[.]ru</strong>, a hacktivist website for organizing cyberattacks against Georgia that appeared at the same time <a href="https://en.wikipedia.org/wiki/Russo-Georgian_War" target="_blank" rel="noopener">Russian forces invaded the former Soviet nation in 2008</a>. That conflict was thought to be the first war ever fought in which a notable cyberattack and an actual military engagement happened simultaneously.</p>
<p>Responding to questions from KrebsOnSecurity, Mr. Nesterenko said he couldn&#8217;t say whether his network had ever hosted the StopGeorgia website back in 2008 because his company didn&#8217;t keep records going back that far. But he said Stark Industries Solutions is indeed one of MIRhsoting&#8217;s colocation customers.</p>
<p>&#8220;Our relationship is purely provider-customer,&#8221; Nesterenko said. &#8220;They also utilize multiple providers and data centers globally, so connecting them directly to MIRhosting overlooks their broader network.&#8221;</p>
<p>&#8220;We take any report of malicious activity seriously and are always open to information that can help us identify and prevent misuse of our infrastructure, whether involving Stark Industries or any other customer,&#8221; Nesterenko continued. &#8220;In cases where our services are exploited for malicious purposes, we collaborate fully with Dutch cyber police and other relevant authorities to investigate and take appropriate measures. However, we have yet to receive any actionable information beyond the article itself, which has not provided us with sufficient detail to identify or block malicious actors.&#8221;</p>
<p>In December 2022, security firm Recorded Future <a href="https://industrialcyber.co/ransomware/recorded-future-details-tag-53-activity-used-for-russia-aligned-espionage-operations/" target="_blank" rel="noopener">profiled</a> the phishing and credential harvesting infrastructure used for Russia-aligned espionage operations by a group dubbed <strong>Blue Charlie </strong>(aka <strong>TAG-53</strong>), which has targeted email accounts of nongovernmental organizations and think tanks, journalists, and government and defense officials.</p>
<p>Recorded Future found that virtually all the Blue Charlie domains existed in just ten different ISPs, with a significant concentration located in two networks, one of which was MIRhosting. Both <a href="https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/" target="_blank" rel="noopener">Microsoft</a> and the <a href="https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet" target="_blank" rel="noopener">UK government</a> assess that Blue Charlie is linked to the Russian threat activity groups variously known as <strong>Callisto Group</strong>, <strong>COLDRIVER</strong>, and <strong>SEABORGIUM</strong>.</p>
<p>Mr. Nesterenko took exception to Recorded Future&#8217;s report.</p>
<p>&#8220;We&#8217;ve discussed its contents with our customer, Stark Industries,&#8221; he said. &#8220;We understand that they have initiated legal proceedings against the website in question, as they firmly believe that the claims made are inaccurate.&#8221;</p>
<p>Recorded Future said they updated their story with comments from Mr. Nesterenko, but that they stand by their reporting.</p>
<p>Mr. Nesterenko&#8217;s LinkedIn profile says he was previously the foreign region sales manager at <strong>Serverius-as</strong>, a hosting company in The Netherlands that remains in the same data center as MIRhosting.</p>
<p>In February, the Dutch police <a href="https://www.security.nl/posting/830342/Nederlandse+politie+haalde+dertien+servers+LockBit-ransomware+offline" target="_blank" rel="noopener">took 13 servers offline</a> that were used by the infamous <a href="https://krebsonsecurity.com/tag/lockbit/" target="_blank" rel="noopener">LockBit ransomware group</a>, which had originally <a href="https://www.nrc.nl/nieuws/2023/07/19/zit-de-oudste-en-gevaarlijkste-gijzelsoftwarebende-in-nederland-a4170138" target="_blank" rel="noopener">bragged on its darknet website</a> that its home base was in The Netherlands. Sources tell KrebsOnSecurity the servers seized by the Dutch police were located in Serverius&#8217; data center in Dronten, which is also shared by MIRhosting.</p>
<p>Serverius-as did not respond to requests for comment. Nesterenko said MIRhosting does use one of Serverius&#8217;s data centers for its operations in the Netherlands, alongside two other data centers, but that the recent incident involving the seizure of servers has no connection to MIRhosting.</p>
<p>&#8220;We are legally prohibited by Dutch law and police regulations from sharing information with third parties regarding any communications we may have had,&#8221; he said.</p>
<p>A February 2024 report from security firm <strong>ESET</strong> <a href="https://www.welivesecurity.com/en/eset-research/operation-texonto-information-operation-targeting-ukrainian-speakers-context-war/" target="_blank" rel="noopener">found</a> Serverius-as systems were involved in a series of targeted phishing attacks by Russia-aligned groups against Ukrainian entities throughout 2023. ESET observed that after the spearphishing domains were no longer active, they were converted to promoting rogue Internet pharmacy websites.</p>
<h2>PEERING INTO THE VOID</h2>
<p>A review of the Internet address ranges recently added to the network operated by Stark Industries Solutions offers some insight into its customer base, usage, and maybe even true origins. <a href="media/f65d7a76.44477.originations.in_.May2024.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/44477.originations.in_.May2024.pdf" target="_blank" rel="noopener">Here is a snapshot</a> (PDF) of all Internet address ranges announced by Stark Industries so far in the month of May 2024 (this information was graciously collated by the network observability platform <a href="https://kentik.com" target="_blank" rel="noopener">Kentik.com</a>).</p>
<p>Those records indicate that the largest portion of the IP space used by Stark is in The Netherlands, followed by Germany and the United States. Stark says it is connected to roughly 4,600 Internet addresses that currently list their ownership as <strong>Comcast Cable Communications</strong>.</p>
<p>A review of those address ranges <a href="https://app.spur.us/context?q=50.114.164.2" target="_blank" rel="noopener">at spur.us</a> shows all of them are connected to an entity called <strong>Proxyline</strong>, which is a sprawling proxy service based in Russia that currently says it has more than 1.6 million proxies globally that are available for rent.</p>
<div id="attachment_67547" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67547" decoding="async" loading="lazy" class=" wp-image-67547" src="media/5c5ad868.proxyline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/proxyline.png" alt="" width="750" height="490" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/proxyline.png 1320w, https://krebsonsecurity.com/wp-content/uploads/2024/05/proxyline-768x502.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/proxyline-782x511.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67547" class="wp-caption-text">Proxyline dot net.</p></div>
<p>Reached for comment, Comcast said the Internet address ranges never did belong to Comcast, so it is likely that Stark has been fudging the real location of its routing announcements in some cases.</p>
<p>Stark reports that it has more than 67,000 Internet addresses at Santa Clara, Calif.-based <strong>EGIhosting.</strong> Spur says the Stark addresses involving EGIhosting all map to Proxyline as well. EGIhosting did not respond to requests for comment.</p>
<p>EGIhosting manages Internet addresses for the Cyprus-based hosting firm <strong>ITHOSTLINE LTD</strong> (aka <strong>HOSTLINE-LTD</strong>), which is represented throughout Stark&#8217;s announced Internet ranges. Stark says it has more than 21,000 Internet addresses with HOSTLINE. Spur.us finds Proxyline addresses are especially concentrated in the Stark ranges labeled ITHOSTLINE LTD, HOSTLINE-LTD, and <strong>Proline IT</strong>.</p>
<p>Stark&#8217;s network list includes approximately 21,000 Internet addresses at Hockessin, De. based <strong>DediPath</strong>, which <a href="https://medium.com/@leasepacket/finding-the-best-dedipath-alternative-after-dedipath-closure-7eb5c62b3b30#:~:text=DediPath%2C%20a%20hosting%20provider%20based,regret%20for%20the%20inconvenience%20caused." target="_blank" rel="noopener">abruptly ceased operations without warning</a> in August 2023. According to a phishing report released last year by <strong>Interisle Consulting</strong>, DediPath was the fourth most common source of phishing attacks in the year ending Oct. 2022. Spur.us likewise finds that virtually all of the <a href="https://app.spur.us/context?q=139.28.233.0" target="_blank" rel="noopener">Stark address ranges marked &#8220;DediPath LLC&#8221;</a> are tied to Proxyline.</p>
<div id="attachment_67556" style="width: 805px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67556" decoding="async" loading="lazy" class="size-full wp-image-67556" src="media/c28ea6ca.dedipath.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/dedipath.png" alt="" width="795" height="432" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/dedipath.png 795w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dedipath-768x417.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dedipath-782x425.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/05/dedipath-370x200.png 370w" sizes="(max-width: 795px) 100vw, 795px" /><p id="caption-attachment-67556" class="wp-caption-text">Image: Interisle Consulting.</p></div>
<p>A large number of the Internet address ranges announced by Stark in May originate in India, and the names that are self-assigned to many of these networks indicate they were previously used to send large volumes of spam for herbal medicinal products, with names like <strong>HerbalFarm</strong>, <strong>AdsChrome</strong>, <strong>Nutravo</strong>, <strong>Herbzoot</strong> and <strong>Herbalve</strong>.</p>
<p>The anti-spam organization <strong>SpamHaus</strong> <a href="https://check.spamhaus.org/listed/?searchterm=SBL631580" target="_blank" rel="noopener">reports</a> that many of the Indian IP address ranges are associated with known &#8220;snowshoe spam,&#8221; a form of abuse that involves mass email campaigns spread across several domains and IP addresses to weaken reputation metrics and avoid spam filters.</p>
<p>It&#8217;s not clear how much of Stark&#8217;s network address space traces its origins to Russia, but big chunks of it recently belonged to some of the oldest entities on the Russian Internet (a.k.a. &#8220;Runet&#8221;).</p>
<p>For example, many Stark address ranges were most recently assigned to a Russian government entity whose full name is the &#8220;<strong>Federal State Autonomous Educational Establishment of Additional Professional Education Center of Realization of State Educational Policy and Informational Technologies</strong>.&#8221;</p>
<p>A review of <a href="https://whoisrequest.com/ip/AS8291" target="_blank" rel="noopener">Internet address ranges adjacent to this entity</a> reveals a long list of Russian government organizations that are part of the <strong>Federal Guard Service of the Russian Federation</strong>. <a href="https://en.wikipedia.org/wiki/Federal_Protective_Service_(Russia)#:~:text=The%20Federal%20Protective%20Service%2C%20or,the%20tasks%20related%20to%20the" target="_blank" rel="noopener">Wikipedia says</a> the Federal Guard Service is a Russian federal government agency concerned with tasks related to protection of several high-ranking state officials, including the President of Russia, as well as certain federal properties. The agency traces its origins to the USSR&#8217;s Ninth Directorate of the KGB, and later the presidential security service.</p>
<p>Stark recently announced the address range 213.159.64.0/20 from April 27 to May 1, and this range was previously assigned to an ancient ISP in St. Petersburg, RU called the <strong>Computer Technologies Institute Ltd.</strong></p>
<p>According to a post on the Russian language webmaster forum searchengines[.]ru, the domain for Computer Technologies Institute &#8212; <strong>ctinet[.]ru</strong> &#8212; <em>is the seventh-oldest domain in the entire history of the Runet.</em></p>
<p>Curiously, Stark also lists large tracts of Internet addresses (close to 48,000 in total) assigned to a small ISP in Kharkiv, Ukraine called <strong>NetAssist</strong>. Reached via email, the CEO of NetAssist <strong>Max Tulyev</strong> confirmed his company provides a number of services to PQ Hosting.</p>
<p>&#8220;We colocate their equipment in Warsaw, Madrid, Sofia and Thessaloniki, provide them IP transit and IPv4 addresses,&#8221; Tulyev said. &#8220;For their size, we receive relatively low number of complains to their networks. I never seen anything about their pro-Russian activity or support of Russian hackers. It is very interesting for me to see proofs of your accusations.&#8221;</p>
<p>Spur.us mapped the entire infrastructure of Proxyline, and found more than one million proxies across multiple providers, but by far the biggest concentration was at Stark Industries Solutions. The <a href="https://krebsonsecurity.com/wp-content/uploads/2024/05/proxyline-by-as.csv" target="_blank" rel="noopener">full list of Proxyline address ranges</a> (.CSV) shows two other ISPs appear repeatedly throughout the list. One is Kharkiv, Ukraine based <strong>ITL LLC</strong>, also known as <strong>Information Technology Laboratories Group</strong>, and <strong>Integrated Technologies Laboratory.</strong></p>
<p>The second is a related hosting company in Miami, called <strong>Green Floid LLC</strong>. Green Floid featured in <a href="https://money.cnn.com/2017/10/25/media/itl-green-floid-cloudflare-russian-sites/index.html" target="_blank" rel="noopener">a 2017 scoop by CNN</a>, which profiled the company&#8217;s owner and quizzed him about Russian troll farms using proxy networks on Green Floid and its parent firm ITL to mask disinformation efforts tied to the Kremlin&#8217;s <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency" target="_blank" rel="noopener">Internet Research Agency</a> (IRA). At the time, the IRA was using Facebook and other social media networks to spread videos showing police brutality against African Americans in an effort to encourage protests across the United States.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67564" src="media/4b3e8adf.cnn-troll.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/cnn-troll.png" alt="" width="750" height="679" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/cnn-troll.png 885w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cnn-troll-768x695.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cnn-troll-782x708.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p><strong>Doug Madory</strong>, director of Internet analysis at Kentik, was able to see at a high level the top sources and destinations for traffic traversing Stark&#8217;s network.</p>
<p>&#8220;Based on our aggregate NetFlow, we see Iran as the top destination (35.1%) for traffic emanating from Stark (AS44477),&#8221; Madory said. &#8220;Specifically, the top destination is MTN Irancell, while the top source is Facebook. This data supports the theory that AS44477 houses proxy services as Facebook is blocked in Iran.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67661
title: Treasury Sanctions Creators of 911 S5 Proxy Botnet
uri: Treasury-Sanctions-Creators-of-911-S5-Proxy-Botnet
url: https://krebsonsecurity.com/2024/05/treasury-sanctions-creators-of-911-s5-proxy-botnet/
content:
<p><strong>The U.S. Department of the Treasury</strong> today unveiled sanctions against three Chinese nationals for allegedly operating <strong>911 S5</strong>, an online anonymity service that for many years was the easiest and cheapest way to route one&#8217;s Web traffic through malware-infected computers around the globe. KrebsOnSecurity identified one of the three men in a July 2022 investigation into 911 S5, which was massively hacked and then closed ten days later.</p>
<div id="attachment_60396" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60396" decoding="async" class=" wp-image-60396" src="media/c4a58664.s5now.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now.png" alt="" width="749" height="422" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now-768x433.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now-782x441.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-60396" class="wp-caption-text">The 911 S5 botnet-powered proxy service, circa July 2022.</p></div>
<p>From 2015 to July 2022, 911 S5 sold access to hundreds of thousands of <strong>Microsoft Windows</strong> computers daily, as &#8220;proxies&#8221; that allowed customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States.</p>
<p>911 built its proxy network mainly by offering &#8220;free&#8221; virtual private networking (VPN) services. 911&#8217;s VPN performed largely as advertised for the user &#8212; allowing them to surf the web anonymously &#8212; but it also quietly turned the user&#8217;s computer into a traffic relay for paying 911 S5 customers.</p>
<p>911 S5&#8217;s reliability and extremely low prices quickly made it one of the most popular services among denizens of the cybercrime underground, and the service became almost shorthand for connecting to that “last mile” of cybercrime. Namely, the ability to route one’s malicious traffic through a computer that is geographically close to the consumer whose stolen credit card is about to be used, or whose bank account is about to be emptied.</p>
<p>In July 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">published a deep dive into 911 S5</a>, which found the people operating this business had a history of encouraging the installation of their proxy malware by any means available. That included paying affiliates to distribute their proxy software by secretly bundling it with other software.</p>
<div id="attachment_60380" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60380" decoding="async" loading="lazy" class=" wp-image-60380" src="media/7240a3b1.exebucks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png" alt="" width="750" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png 917w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-768x539.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-782x549.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60380" class="wp-caption-text">A cached copy of flashupdate dot net, a pay-per-install affiliate program that incentivized the silent installation of 911&#8217;s proxy software.</p></div>
<p>That story named <strong>Yunhe Wang</strong> from Beijing as the apparent owner or manager of the 911 S5 proxy service. In today&#8217;s Treasury action, Mr. Wang was named as the primary administrator of the botnet that powered 911 S5.</p>
<p>&#8220;A review of records from network infrastructure service providers known to be utilized by 911 S5 and two Virtual Private Networks (VPNs) specific to the botnet operation (MaskVPN and DewVPN) showed Yunhe Wang as the registered subscriber to those providers&#8217; services,&#8221; reads <a href="https://home.treasury.gov/news/press-releases/jy2375" target="_blank" rel="noopener">the Treasury announcement</a>.</p>
<p>The sanctions say <strong>Jingping Liu</strong> was Yunhe Wang’s co-conspirator in the laundering of criminally derived proceeds generated from 911 S5, mainly virtual currency. The government alleges the virtual currencies paid by 911 S5 users were converted into U.S. dollars using over-the-counter vendors who wired and deposited funds into bank accounts held by Liu.</p>
<p>&#8220;Jingping Liu assisted Yunhe Wang by laundering criminally derived proceeds through bank accounts held in her name that were then utilized to purchase luxury real estate properties for Yunhe Wang,&#8221; the document continues. &#8220;These individuals leveraged their malicious botnet technology to compromise personal devices, enabling cybercriminals to fraudulently secure economic assistance intended for those in need and to terrorize our citizens with bomb threats.&#8221;<span id="more-67661"></span></p>
<p>The third man sanctioned is <strong>Yanni Zheng</strong>, a Chinese national the U.S. Treasury says acted as an attorney for Wang and his firm &#8212; <strong>Spicy Code Company Limited</strong> &#8212; and helped to launder proceeds from the business into real estate holdings. Spicy Code Company was also sanctioned, as well as Wang-controlled properties <strong>Tulip</strong> <strong>Biz Pattaya Group Company Limited</strong>, and <strong>Lily Suites Company Limited</strong>.</p>
<p>Ten days after the July 2022 story here on 911 S5, the proxy network abruptly closed up shop, citing <a href="https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/" target="_blank" rel="noopener">a data breach that destroyed key components of its business operations</a>.</p>
<p>In the months that followed, however, 911 S5 would resurrect itself under a different name: <strong>Cloud Router</strong>. That&#8217;s according to <strong>spur.us</strong>, a U.S.-based startup that tracks proxy and VPN services. In February 2024, Spur <a href="https://spur.us/cloudrouter-911-proxy-resurrected/" target="_blank" rel="noopener">published research</a> showing the Cloud Router operators reused many of the same components from 911 S5, making it relatively simple to draw a connection between the two.</p>
<div id="attachment_67662" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67662" decoding="async" loading="lazy" class=" wp-image-67662" src="media/4a502b40.cloudrouter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter.png" alt="" width="750" height="407" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter.png 838w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter-768x417.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter-782x425.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter-370x200.png 370w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67662" class="wp-caption-text">The Cloud Router homepage, which according to Spur has been unreachable since this past weekend.</p></div>
<p>Spur found that Cloud Router was being powered by a new VPN service called <strong>PaladinVPN</strong>, which made it much more explicit to users that their Internet connections were going to be used to relay traffic for others. At the time, Spur found Cloud Router had more than 140,000 Internet addresses for rent.</p>
<p>Spur co-founder <strong>Riley Kilmer</strong> said Cloud Router appears to have suspended or ceased operations sometime this past weekend. Kilmer said the number of proxies advertised by the service had been trending downwards quite recently before the website suddenly went offline.</p>
<p>Cloud Router&#8217;s homepage is currently populated by a message from Cloudflare saying the site&#8217;s domain name servers are pointing to a &#8220;prohibited IP.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67679
title: Is Your Computer Part of ‘The Largest Botnet Ever?’
uri: Is-Your-Computer-Part-of-The-Largest-Botnet-Ever
url: https://krebsonsecurity.com/2024/05/is-your-computer-part-of-the-largest-botnet-ever/
content:
<p>The <strong>U.S. Department of Justice</strong> (DOJ) today said they arrested the alleged operator of <strong>911 S5</strong>, a ten-year-old online anonymity service that was powered by what the director of the FBI called &#8220;likely the world&#8217;s largest botnet ever.&#8221; The arrest coincided with the seizure of the 911 S5 website and supporting infrastructure, which the government says turned computers running various &#8220;free VPN&#8221; products into Internet traffic relays that facilitated billions of dollars in online fraud and cybercrime.</p>
<div id="attachment_67662" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67662" decoding="async" class=" wp-image-67662" src="media/4a502b40.cloudrouter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter.png" alt="" width="750" height="407" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter.png 838w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter-768x417.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter-782x425.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouter-370x200.png 370w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67662" class="wp-caption-text">The Cloud Router homepage, which was seized by the FBI this past weekend. Cloud Router was previously called 911 S5.</p></div>
<p>On May 24, authorities in Singapore arrested the alleged creator and operator of 911 S5, a 35-year-old Chinese national named <strong>YunHe Wang</strong>. In a statement on his arrest today, the DOJ said 911 S5 enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.</p>
<p>For example, the government estimates that 560,000 fraudulent unemployment insurance claims originated from compromised Internet addresses, resulting in a confirmed fraudulent loss exceeding $5.9 billion.</p>
<p>&#8220;Additionally, in evaluating suspected fraud loss to the Economic Injury Disaster Loan (EIDL) program, the United States estimates that more than 47,000 EIDL applications originated from IP addresses compromised by 911 S5,&#8221; the DOJ <a href="https://www.justice.gov/opa/pr/911-s5-botnet-dismantled-and-its-administrator-arrested-coordinated-international-operation" target="_blank" rel="noopener">wrote</a>. &#8220;Millions of dollars more were similarly identified by financial institutions in the United States as loss originating from IP addresses compromised by 911 S5.&#8221;</p>
<p>From 2015 to July 2022, 911 S5 sold access to hundreds of thousands of <strong>Microsoft Windows</strong> computers daily, as “proxies” that allowed customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-31323" src="media/2591b79f.proxy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png" alt="" width="748" height="313" /></p>
<p>911 S5 built its proxy network mainly by offering “free” virtual private networking (VPN) services. 911’s VPN performed largely as advertised for the user — allowing them to surf the web anonymously — but it also quietly turned the user’s computer into a traffic relay for paying 911 S5 customers.</p>
<p>911 S5’s reliability and extremely low prices quickly made it one of the most popular services among denizens of the cybercrime underground, and the service became almost shorthand for connecting to that “last mile” of cybercrime. Namely, the ability to route one’s malicious traffic through a computer that is geographically close to the consumer whose stolen credit card is about to be used, or whose bank account is about to be emptied.</p>
<div id="attachment_60398" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60398" decoding="async" loading="lazy" class=" wp-image-60398" src="media/2dc9c71d.s5prices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices.png" alt="" width="749" height="429" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices-768x440.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices-782x448.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-60398" class="wp-caption-text">The prices page for 911 S5, circa July 2022. $28 would let users cycle through 150 proxies on this popular service.</p></div>
<p>KrebsOnSecurity first identified Mr. Wang as the proprietor of the popular service in <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">a deep dive on 911 S5 published in July 2022</a>. That story showed that 911 S5 had a history of paying people to install its software by secretly bundling it with other software &#8212; including fake security updates for common programs like Flash Player, and &#8220;cracked&#8221; or pirated commercial software distributed on file-sharing networks.</p>
<p>Ten days later, 911 S5 closed up shop, <a href="https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/" target="_blank" rel="noopener">claiming it had been hacked</a>. But experts soon tracked <a href="https://spur.us/cloudrouter-911-proxy-resurrected/" target="_blank" rel="noopener">the reemergence of the proxy network</a> by another name: <strong>Cloud Router</strong>.</p>
<p>The announcement of Wang&#8217;s arrest came less than 24 hours after the <strong>U.S. Department of the Treasury</strong> <a href="https://krebsonsecurity.com/2024/05/treasury-sanctions-creators-of-911-s5-proxy-botnet/" target="_blank" rel="noopener">sanctioned Wang and two associates</a>, as well as several companies the men allegedly used to launder the nearly $100 million in proceeds from 911 S5 and Cloud Router customers.</p>
<p>Cloud Router&#8217;s homepage now features a notice saying the domain has been <a href="https://www.justice.gov/opa/media/1353521/dl?inline" target="_blank" rel="noopener">seized by the U.S. government</a>. In addition, the DOJ says it worked with authorities in Singapore, Thailand and Germany to search residences tied to the defendant, and seized approximately $30 million in assets.</p>
<div id="attachment_67681" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67681" decoding="async" loading="lazy" class=" wp-image-67681" src="media/50cbee43.cloudrouterseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouterseized.png" alt="" width="749" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouterseized.png 1375w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouterseized-768x464.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouterseized-782x473.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-67681" class="wp-caption-text">The Cloud Router homepage now features a seizure notice from the FBI in multiple languages.</p></div>
<p>Those assets included a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, several luxury wristwatches, and 21 residential or investment properties.<span id="more-67679"></span></p>
<p>The government says Wang is charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. If convicted on all counts, he faces a maximum penalty of 65 years in prison.</p>
<p><strong>Brett Leatherman</strong>, deputy assistant director of the FBI&#8217;s Cyber Division, said the DOJ is working with the Singaporean government on extraditing Wang to face charges in the United States.</p>
<p>Leatherman encouraged Internet users to visit <a href="https://www.fbi.gov/911S5" target="_blank" rel="noopener">a new FBI webpage</a> that can help people determine whether their computers may be part of the 911 S5 botnet, which the government says spanned more than 19 million individual computers in at least 190 countries.</p>
<p>Leatherman said 911 S5 and Cloud Router used several &#8220;free VPN&#8221; brands to lure consumers into installing the proxy service, including <strong>MaskVPN</strong>, <strong>DewVPN</strong>, <strong>PaladinVPN</strong>, <strong>Proxygate</strong>, <strong>Shield VPN</strong>, and <strong>ShineVPN</strong>.</p>
<p>&#8220;American citizens who didn&#8217;t know that their IP space was being utilized to attack US businesses or defraud the U.S. government, they were unaware,&#8221; Leatherman said. &#8220;But these kind of operations breed that awareness.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67691
title: ‘Operation Endgame’ Hits Malware Delivery Platforms
uri: Operation-Endgame-Hits-Malware-Delivery-Platforms
url: https://krebsonsecurity.com/2024/05/operation-endgame-hits-malware-delivery-platforms/
content:
<p>Law enforcement agencies in the United States and Europe today announced <strong>Operation Endgame</strong>, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. Dubbed &#8220;the largest ever operation against botnets,&#8221; the international effort is being billed as the opening salvo in an ongoing campaign targeting advanced malware &#8220;droppers&#8221; or &#8220;loaders&#8221; like <strong>IcedID</strong>, <strong>Smokeloader</strong> and <strong>Trickbot</strong>.</p>
<div id="attachment_67699" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67699" decoding="async" class=" wp-image-67699" src="media/642bbb0b.endgamestill.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/endgamestill.png" alt="" width="749" height="678" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/endgamestill.png 998w, https://krebsonsecurity.com/wp-content/uploads/2024/05/endgamestill-768x696.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/endgamestill-782x708.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-67699" class="wp-caption-text">A frame from one of three animated videos released today in connection with Operation Endgame.</p></div>
<p>Operation Endgame targets the cybercrime ecosystem supporting droppers/loaders, slang terms used to describe tiny, custom-made programs designed to surreptitiously install malware onto a target system. Droppers are typically used in the initial stages of a breach, and they allow cybercriminals to bypass security measures and deploy additional harmful programs, including viruses, ransomware, or spyware.</p>
<p>Droppers like IcedID are most often deployed through email attachments, hacked websites, or bundled with legitimate software. For example, cybercriminals have long used <a href="https://krebsonsecurity.com/2024/01/using-google-search-to-find-software-can-be-risky/" target="_blank" rel="noopener">paid ads on Google to trick people into installing malware</a> disguised as popular free software, such as Microsoft Teams, Adobe Reader and Discord. In those cases, the dropper is the hidden component bundled with the legitimate software that quietly loads malware onto the user&#8217;s system.</p>
<p>Droppers remain such a critical, human-intensive component of nearly all major cybercrime enterprises that the most popular have turned into full-fledged cybercrime services of their own. By targeting the individuals who develop and maintain dropper services and their supporting infrastructure, authorities are hoping to disrupt multiple cybercriminal operations simultaneously.</p>
<p>According to <a href="https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem" target="_blank" rel="noopener">a statement</a> from the European police agency <strong>Europol</strong>, between May 27 and May 29, 2024 authorities arrested four suspects (one in Armenia and three in Ukraine), and disrupted or took down more than 100 Internet servers in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, United States and Ukraine. Authorities say they also seized more than 2,000 domain names that supported dropper infrastructure online.</p>
<p>In addition, Europol released information on eight fugitives suspected of involvement in dropper services and who are wanted by Germany; their names and photos were added to Europol&#8217;s &#8220;Most Wanted&#8221; list on 30 May 2024.<span id="more-67691"></span></p>
<div id="attachment_67696" style="width: 758px" class="wp-caption aligncenter"><a href="media/568cab55.europol-mostwanted-de.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/europol-mostwanted-de.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67696" decoding="async" loading="lazy" class="wp-image-67696" src="media/568cab55.europol-mostwanted-de.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/europol-mostwanted-de.png" alt="" width="748" height="329" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/europol-mostwanted-de.png 1307w, https://krebsonsecurity.com/wp-content/uploads/2024/05/europol-mostwanted-de-768x337.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/europol-mostwanted-de-782x343.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-67696" class="wp-caption-text">A &#8220;wanted&#8221; poster including the names and photos of eight suspects wanted by Germany and now on Europol&#8217;s &#8220;Most Wanted&#8221; list.</p></div>
<p>&#8220;It has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware,&#8221; Europol wrote. &#8220;The suspect’s transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtained.&#8221;</p>
<p>There have been <a href="https://krebsonsecurity.com/2023/08/u-s-hacks-qakbot-quietly-removes-botnet-infections/" target="_blank" rel="noopener">numerous such coordinated malware takedown efforts</a> in the past, and yet often the substantial amount of coordination required between law enforcement agencies and cybersecurity firms involved is not sustained after the initial disruption and/or arrests.</p>
<p>But a new website erected to detail today&#8217;s action &#8212; <a href="https://www.operation-endgame.com" target="_blank" rel="noopener">operation-endgame.com</a> &#8212; makes the case that this time is different, and that more takedowns and arrests are coming. &#8220;Operation Endgame does not end today,&#8221; the site promises. &#8220;New actions will be announced on this website.&#8221;</p>
<div id="attachment_67697" style="width: 643px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67697" decoding="async" loading="lazy" class="size-full wp-image-67697" src="media/a19b2ac9.endgame-think.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/endgame-think.png" alt="" width="633" height="521" /><p id="caption-attachment-67697" class="wp-caption-text">A message on operation-endgame.com promises more law enforcement and disruption actions.</p></div>
<p>Perhaps in recognition that many of today&#8217;s top cybercriminals reside in countries that are effectively beyond the reach of international law enforcement, actions like Operation Endgame seem increasingly focused on mind games &#8212; i.e., trolling the hackers.</p>
<p>Writing in this month&#8217;s issue of <em>Wired</em>, <strong>Matt Burgess</strong> makes the case that Western law enforcement officials have turned to psychological measures as an added way to slow down Russian hackers and cut to the heart of the sweeping cybercrime ecosystem.</p>
<p>&#8220;These nascent psyops include efforts to erode the limited trust the criminals have in each other, driving subtle wedges between fragile hacker egos, and sending offenders personalized messages showing they’re being watched,&#8221; Burgess <a href="https://www.wired.com/story/cop-cybercriminal-hacker-psyops/" target="_blank" rel="noopener">wrote</a>.</p>
<p>When authorities in the U.S. and U.K. announced in February 2024 that they&#8217;d <a href="https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/" target="_blank" rel="noopener">infiltrated and seized</a> the infrastructure used by the infamous <strong>LockBit</strong> ransomware gang, they borrowed the existing design of LockBit&#8217;s victim shaming website to link instead to press releases about the takedown, and included a countdown timer that was eventually replaced with the personal details of <a href="https://krebsonsecurity.com/2024/05/how-did-authorities-identify-the-alleged-lockbit-boss/" target="_blank" rel="noopener">LockBit&#8217;s alleged leader</a>.</p>
<div id="attachment_66436" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66436" decoding="async" loading="lazy" class=" wp-image-66436" src="media/aadce34b.lockbitseized.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png" alt="" width="750" height="474" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized.png 1379w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-768x486.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/02/lockbitseized-782x494.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66436" class="wp-caption-text">The feds used the existing design on LockBit&#8217;s victim shaming website to feature press releases and free decryption tools.</p></div>
<p>The Operation Endgame website also includes a countdown timer, which serves to tease the release of several animated videos that mimic the same sort of flashy, short advertisements that established cybercriminals often produce to promote their services online. At least two of the videos include a substantial amount of text written in Russian.</p>
<p>The coordinated takedown comes on the heels of another law enforcement action this week against what the director of the FBI called &#8220;<a href="https://krebsonsecurity.com/2024/05/is-your-computer-part-of-the-largest-botnet-ever/" target="_blank" rel="noopener">likely the world&#8217;s largest botnet ever</a>.&#8221; On Wednesday <strong>U.S. Department of Justice</strong> (DOJ) announced the arrest of <strong>YunHe Wang</strong>, the alleged operator of the ten-year-old online anonymity service <strong>911 S5</strong>. The government also seized 911 S5&#8217;s domains and online infrastructure, which allegedly turned computers running various “free VPN” products into Internet traffic relays that facilitated billions of dollars in online fraud and cybercrime.</p>


feed_id: https://krebsonsecurity.com/?p=67754
title: Patch Tuesday, June 2024 “Recall” Edition
uri: Patch-Tuesday-June-2024-Recall-Edition
url: https://krebsonsecurity.com/2024/06/patch-tuesday-june-2024-recall-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix more than 50 security vulnerabilities in <strong>Windows</strong> and related software, a relatively light Patch Tuesday this month for Windows users. The software giant also responded to a torrent of negative feedback on a new feature of Redmond&#8217;s flagship operating system that constantly takes screenshots of whatever users are doing on their computers, saying the feature would no longer be enabled by default.</p>
<p><img decoding="async" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Last month, Microsoft debuted <strong>Copilot+ PCs</strong>, an AI-enabled version of Windows. Copilot+ ships with a feature nobody asked for that Redmond has aptly dubbed <a href="https://support.microsoft.com/en-us/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c" target="_blank" rel="noopener"><strong>Recall</strong></a>, which constantly takes screenshots of what the user is doing on their PC. Security experts roundly trashed Recall as a fancy keylogger, noting that it would be a gold mine of information for attackers if the user&#8217;s PC was compromised with malware.</p>
<p>Microsoft countered that Recall snapshots never leave the user&#8217;s system, and that even if attackers managed to hack a Copilot+ PC they would not be able to exfiltrate on-device Recall data. But that claim rang hollow after former Microsoft threat analyst <strong>Kevin Beaumont</strong> <a href="https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e" target="_blank" rel="noopener">detailed on his blog</a> how any user on the system (even a non-administrator) can export Recall data, which is just stored in an SQLite database locally.</p>
<p>&#8220;I&#8217;m not being hyperbolic when I say this is the dumbest cybersecurity move in a decade,&#8221; Beaumont <a href="https://cyberplace.social/@GossiTheDog/112535509953161486" target="_blank" rel="noopener">said on Mastodon</a>.</p>
<p>In a recent <a href="https://risky.biz/RB750/" target="_blank" rel="noopener">Risky Business podcast</a>, host <strong>Patrick Gray</strong> noted that the screenshots created and indexed by Recall would be a boon to any attacker who suddenly finds himself in an unfamiliar environment.</p>
<p>&#8220;The first thing you want to do when you get on a machine if you&#8217;re up to no good is to figure out how someone did their job,&#8221; Gray said. &#8220;We saw that in the case of the SWIFT attacks against central banks years ago. Attackers had to do screen recordings to figure out how transfers work. And this could speed up that sort of discovery process.&#8221;</p>
<p>Responding to the withering criticism of Recall, Microsoft <a href="https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/?ref=news.risky.biz" target="_blank" rel="noopener">said last week</a> that it will no longer be enabled by default on Copilot+ PCs.<span id="more-67754"></span></p>
<p>Only one of the patches released today &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30080" target="_blank" rel="noopener">CVE-2024-30080</a> &#8212; earned Microsoft&#8217;s most urgent &#8220;critical&#8221; rating, meaning malware or malcontents could exploit the vulnerability to remotely seize control over a user&#8217;s system, without any user interaction.</p>
<p>CVE-2024-30080 is a flaw in the <strong>Microsoft Message Queuing</strong> (MSMQ) service that can allow attackers to execute code of their choosing. Microsoft says exploitation of this weakness is likely, enough to encourage users to disable the vulnerable component if updating isn&#8217;t possible in the short run. CVE-2024-30080 has been assigned a CVSS vulnerability score of 9.8 (10 is the worst).</p>
<p><strong>Kevin Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>, said a saving grace is that MSMQ is not a default service on Windows.</p>
<p>&#8220;A Shodan search for MSMQ reveals there are a few thousand potentially internet-facing MSSQ servers that could be vulnerable to zero-day attacks if not patched quickly,&#8221; Breen said.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30078" target="_blank" rel="noopener">CVE-2024-30078</a> is a remote code execution weakness in the <strong>Windows WiFi Driver</strong>, which also has a CVSS score of 9.8. According to Microsoft, an unauthenticated attacker could exploit this bug by sending a malicious data packet to anyone else on the same network &#8212; meaning this flaw assumes the attacker has access to the local network.</p>
<p>Microsoft also fixed a number of serious security issues with its <strong>Office</strong> applications, including at least two remote-code execution flaws, said <strong> Adam Barnett</strong>, lead software engineer at <strong>Rapid7</strong>.</p>
<p>&#8220;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30101" target="_blank" rel="noopener">CVE-2024-30101</a> is a vulnerability in <strong>Outlook</strong>; although the Preview Pane is a vector, the user must subsequently perform unspecified specific actions to trigger the vulnerability and the attacker must win a race condition,&#8221; Barnett said. &#8220;CVE-2024-30104 does not have the Preview Pane as a vector, but nevertheless ends up with a slightly higher CVSS base score of 7.8, since exploitation relies solely on the user opening a malicious file.&#8221;</p>
<p>Separately, Adobe released security updates for <strong>Acrobat</strong>, <strong>ColdFusion</strong>, and <strong>Photoshop</strong>, <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">among others</a>.</p>
<p>As usual, the <a href="https://isc.sans.edu/forums/diary/Microsoft%20Patch%20Tuesday%20June%202024/31000/" target="_blank" rel="noopener">SANS Internet Storm Center</a> has the skinny on the individual patches released today, indexed by severity, exploitability and urgency. Windows admins should also keep an eye on <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a>, which often publishes early reports of any Windows patches gone awry.</p>


feed_id: https://krebsonsecurity.com/?p=67776
title: Alleged Boss of ‘Scattered Spider’ Hacking Group Arrested
uri: Alleged-Boss-of-Scattered-Spider-Hacking-Group-Arrested
url: https://krebsonsecurity.com/2024/06/alleged-boss-of-scattered-spider-hacking-group-arrested/
content:
<p>A 22-year-old man from the United Kingdom arrested this week in Spain is allegedly the ringleader of <strong>Scattered Spider</strong>, a cybercrime group suspected of hacking into <strong>Twilio</strong>, <strong>LastPass</strong>, <strong>DoorDash</strong>, <strong>Mailchimp</strong>, and nearly 130 other organizations over the past two years.</p>
<p>The Spanish daily <em>Murcia Today</em> reports the suspect was wanted by the FBI and arrested in <a href="https://en.wikipedia.org/wiki/Palma_de_Mallorca" target="_blank" rel="noopener">Palma de Mallorca</a> as he tried to board a flight to Italy.</p>
<div id="attachment_67783" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67783" decoding="async" class=" wp-image-67783" src="media/49a7c375.tylerb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/tylerb.png" alt="" width="750" height="309" /><p id="caption-attachment-67783" class="wp-caption-text">A still frame from a video released by the Spanish national police shows Tylerb in custody at the airport.</p></div>
<p>&#8220;He stands accused of hacking into corporate accounts and stealing critical information, which allegedly enabled the group to access multi-million-dollar funds,&#8221; Murcia Today <a href="https://murciatoday.com/video-fbi-take-down-uk-hacker-in-spain-for-stealing-27m-usd-of-bitcoins_1000077536-a.html#:~:text=A%2022-year-old%20British,board%20a%20flight%20to%20Italy" target="_blank" rel="noopener">wrote</a>. &#8220;According to Palma police, at one point he controlled Bitcoins worth $27 million.&#8221;</p>
<p>The cybercrime-focused Twitter/X account <strong>vx-underground</strong> said the U.K. man arrested was a <strong>SIM-swapper</strong> who went by the alias &#8220;<strong>Tyler</strong>.&#8221; In a SIM-swapping attack, crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls sent to the victim &#8212; including one-time passcodes for authentication, or password reset links sent via SMS.</p>
<p>&#8220;He is a known SIM-swapper and is allegedly involved with the infamous Scattered Spider group,&#8221; vx-underground <a href="https://x.com/vxunderground/status/1801962119316853148" target="_blank" rel="noopener">wrote</a> on June 15, referring to a prolific gang implicated in <a href="https://www.wired.com/story/mgm-ceasars-hack-ransomware/" target="_blank" rel="noopener">costly data ransom attacks at MGM and Caesars casinos</a> in Las Vegas last year.</p>
<p>Sources familiar with the investigation told KrebsOnSecurity the accused is a 22-year-old from Dundee, Scotland named <strong>Tyler Buchanan</strong>, also allegedly known as &#8220;<strong>tylerb</strong>&#8221; on Telegram chat channels centered around SIM-swapping.</p>
<p>In January 2024, U.S. authorities <a href="https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/" target="_blank" rel="noopener">arrested another alleged Scattered Spider member</a> &#8212; 19-year-old <strong>Noah Michael Urban</strong> of Palm Coast, Fla. &#8212; and charged him with stealing at least $800,000 from five victims between August 2022 and March 2023. Urban allegedly went by the nicknames &#8220;<strong>Sosa</strong>&#8221; and &#8220;<strong>King Bob,</strong>&#8221; and is believed to be part of the same crew that hacked Twilio and a slew of other companies in 2022.</p>
<p>Investigators say Scattered Spider members are part of a more diffuse cybercriminal community online known as &#8220;<strong>The Com</strong>,&#8221; wherein hackers from different cliques boast loudly about high-profile cyber thefts that almost invariably begin with social engineering — tricking people over the phone, email or SMS into giving away credentials that allow remote access to corporate internal networks.</p>
<p>One of the more popular SIM-swapping channels on Telegram maintains a frequently updated leaderboard of the most accomplished SIM-swappers, indexed by their supposed conquests in stealing cryptocurrency. That leaderboard currently lists Sosa as #24 (out of 100), and Tylerb at #65.<span id="more-67776"></span></p>
<h2>0KTAPUS</h2>
<p>In August 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/08/how-1-time-passcodes-became-a-corporate-liability/" target="_blank" rel="noopener">wrote about peering inside the data harvested in a months-long cybercrime campaign by Scattered Spider</a> involving countless SMS-based phishing attacks against employees at major corporations. The security firm <strong>Group-IB</strong> called the gang by a different name &#8212; <strong>0ktapus</strong>, a nod to how the criminal group phished employees for credentials.</p>
<p>The missives asked users to click a link and log in at a phishing page that mimicked their employer’s <strong>Okta</strong> authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication.</p>
<p>These phishing attacks used newly-registered domains that often included the name of the targeted company, and sent text messages urging employees to click on links to these domains to view information about a pending change in their work schedule. The phishing sites also featured a hidden Telegram instant message bot to forward any submitted credentials in real-time, allowing the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website.</p>
<p>One of Scattered Spider&#8217;s first big victims in its 2022 SMS phishing spree was Twilio, a company that provides services for making and receiving text messages and phone calls. The group then pivoted, using their access to Twilio to attack at least 163 of its customers.</p>
<div id="attachment_61078" style="width: 654px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61078" decoding="async" loading="lazy" class="wp-image-61078 size-full" src="media/70fc6af9.twiliophish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/twiliophish.png" alt="" width="644" height="471" /><p id="caption-attachment-61078" class="wp-caption-text">A Scattered Spider phishing lure sent to Twilio employees.</p></div>
<p>Among those was the encrypted messaging app <strong>Signal</strong>, which <a href="https://support.signal.org/hc/en-us/articles/4850133017242-Twilio-Incident-What-Signal-Users-Need-to-Know" target="_blank" rel="noopener">said</a> the breach could have let attackers re-register the phone number on another device for about 1,900 users.</p>
<p>Also in August 2022, several employees at email delivery firm Mailchimp provided their remote access credentials to this phishing group. According to Mailchimp, the attackers used their access to Mailchimp employee accounts to steal data from 214 customers involved in cryptocurrency and finance.</p>
<p>On August 25, 2022, the password manager service LastPass disclosed a breach in which attackers stole some source code and proprietary LastPass technical information, and weeks later LastPass said an investigation revealed no customer data or password vaults were accessed.</p>
<p>However, on November 30, 2022 LastPass disclosed a far more serious breach that the company said leveraged data stolen in the August breach. LastPass said criminal hackers had stolen encrypted copies of some password vaults, as well as other personal information.</p>
<p>In February 2023, LastPass disclosed that the intrusion involved a highly complex, targeted attack against an engineer who was one of only four LastPass employees with access to the corporate vault. In that incident, the attackers exploited a security vulnerability in a Plex media server that the employee was running on his home network, and succeeded in installing malicious software that stole passwords and other authentication credentials. The vulnerability exploited by the intruders was patched back in 2020, but the employee never updated his Plex software.</p>
<p>Plex announced its own data breach one day before LastPass disclosed its initial August intrusion. On August 24, 2022, Plex’s security team urged users to reset their passwords, saying an intruder had accessed customer emails, usernames and encrypted passwords.</p>
<h2>TURF WARS</h2>
<p>Sosa and Tylerb were both subjected to <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">physical attacks from rival SIM-swapping gangs</a>. These communities have been known to settle scores by turning to so-called &#8220;violence-as-a-service&#8221; offerings on cybercrime channels, wherein people can be hired to perform a variety geographically-specific &#8220;in real life&#8221; jobs, such as bricking windows, slashing car tires, or even home invasions.</p>
<p>In 2022, a video surfaced on a popular cybercrime channel purporting to show attackers hurling a brick through a window at an address that matches the spacious and upscale home of Urban’s parents in Sanford, Fl.</p>
<p>January&#8217;s story on Sosa noted that a junior member of his crew named &#8220;Foreshadow&#8221; was <a href="https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/" target="_blank" rel="noopener">kidnapped, beaten and held for ransom in September 2022</a>. Foreshadow&#8217;s captors held guns to his bloodied head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom in exchange for his life (Foreshadow escaped further harm in that incident).</p>
<p>According to several SIM-swapping channels on Telegram where Tylerb was known to frequent, rival SIM-swappers hired thugs to invade his home in February 2023. Those accounts state that the intruders assaulted Tylerb&#8217;s mother in the home invasion, and that they threatened to burn him with a blowtorch if he didn&#8217;t give up the keys to his cryptocurrency wallets. Tylerb was reputed to have fled the United Kingdom after that assault.</p>
<p>KrebsOnSecurity sought comment from Mr. Buchanan, and will update this story in the event he responds.</p>


feed_id: https://krebsonsecurity.com/?p=67806
title: KrebsOnSecurity Threatened with Defamation Lawsuit Over Fake Radaris CEO
uri: KrebsOnSecurity-Threatened-with-Defamation-Lawsuit-Over-Fake-Radaris-C
url:
https://krebsonsecurity.com/2024/06/krebsonsecurity-threatened-with-defamation-lawsuit-over-fake-radaris-ceo/

content:
<p>On March 8, 2024, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">a deep dive</a> on the consumer data broker <strong>Radaris</strong>, showing how the original owners are two men in Massachusetts who operated multiple Russian language dating services and affiliate programs, in addition to a dizzying array of people-search websites. The subjects of that piece are threatening to sue KrebsOnSecurity for defamation unless the story is retracted. Meanwhile, their attorney has admitted that the person Radaris named as the CEO from its inception is a fabricated identity.</p>
<p><img decoding="async" class="wp-image-67916 aligncenter" src="media/6e2506a3.radaris-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/radaris-home.png" alt="" width="750" height="335" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/06/radaris-home.png 1841w, https://krebsonsecurity.com/wp-content/uploads/2024/06/radaris-home-768x343.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/06/radaris-home-1536x687.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/06/radaris-home-782x350.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Radaris is just one cog in a sprawling network of people-search properties online that sell highly detailed background reports on U.S. consumers and businesses. Those reports typically include the subject&#8217;s current and previous addresses, partial Social Security numbers, any known licenses, email addresses and phone numbers, as well as the same information for any of their immediate relatives.</p>
<p>Radaris has a <a href="https://www.bbb.org/us/or/portland/profile/background-checks/radaris-1296-1000153468/complaints" target="_blank" rel="noopener">less-than-stellar reputation</a> when it comes to responding to consumers seeking to have their reports removed from its various people-search services. That poor reputation, combined with indications that the true founders of Radaris have gone to extraordinary lengths to conceal their stewardship of the company, was what prompted KrebsOnSecurity to investigate the origins of Radaris in the first place.</p>
<p>On April 18, KrebsOnSecurity received <a href="media/9ad7b940.Letter-to-Mr.-Krebs-4-19-24-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/Letter-to-Mr.-Krebs-4-19-24-1.pdf" target="_blank" rel="noopener">a certified letter</a> (PDF) from <strong>Valentin &#8220;Val&#8221; Gurvits</strong>, an attorney with the <strong>Boston Law Group</strong>, stating that KrebsOnSecurity would face a withering defamation lawsuit unless the Radaris story was immediately retracted and an apology issued to the two brothers named in the story as co-founders.</p>
<p>That March story worked backwards from the email address used to register radaris.com, and <a href="media/525e7b7a.radaris-mm-782x346.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-782x346.png" target="_blank" rel="noopener">charted an impressive array of data broker companies</a> created over the past 15 years by Massachusetts residents <strong>Dmitry</strong> and <strong>Igor Lubarsky </strong>(also sometimes spelled Lybarsky or Lubarski). Dmitry goes by &#8220;<strong>Dan</strong>,&#8221; and Igor uses the name &#8220;<strong>Gary</strong>.&#8221;</p>
<p>Those businesses included numerous websites marketed to Russian-speaking people who are new to the United States, such as russianamerica.com, newyork.ru, russiancleveland.com, russianla.com, russianmiami.com, etc. Other domains connected to the Lubarskys included Russian-language dating and adult websites, as well as affiliate programs for their international calling card businesses.</p>
<div id="attachment_66716" style="width: 760px" class="wp-caption aligncenter"><a href="media/721990b2.radaris-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66716" decoding="async" loading="lazy" class="wp-image-66716" src="media/721990b2.radaris-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm.png" alt="" width="750" height="332" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm.png 1714w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-768x340.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-1536x679.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/radaris-mm-782x346.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66716" class="wp-caption-text">A mind map of various entities apparently tied to Radaris and the company&#8217;s co-founders. Click to enlarge.</p></div>
<p>The story on Radaris noted that the Lubarsky brothers registered most of their businesses using a made-up name &#8212; &#8220;<strong>Gary Norden</strong>,&#8221; sometimes called <strong>Gary Nord</strong> or <strong>Gary Nard</strong>.</p>
<p>Mr. Gurvits&#8217; letter stated emphatically that my reporting was lazy, mean-spirited, and obviously intended to smear the reputation of his clients. By way of example, Mr. Gurvits said the Lubarskys were actually Ukrainian, and that the story painted his clients in a negative light by insinuating that they were somehow associated with Radaris and with vaguely nefarious elements in Russia.</p>
<p>But more to the point, Mr. Gurvits said, neither of his clients were Gary Norden, and neither had ever held <em>any</em> leadership positions at Radaris, nor were they financial beneficiaries of the company in any way.</p>
<p>&#8220;Neither of my clients is a founder of Radaris, and neither of my clients is the CEOs of Radaris,&#8221; Gurvits wrote. &#8220;Additionally, presently and going back at least the past 10 years, neither of my clients are (or were) officers or employees of Radaris. Indeed, neither of them even owns (or ever owned) any equity in Radaris. In intentional disregard of these facts, the Article implies that my clients are personally responsible for Radaris’ actions. Therefore, you intentionally caused all negative allegations in the Article made with respect to Radaris to be imputed against my clients personally.&#8221;</p>
<div id="attachment_67928" style="width: 261px" class="wp-caption alignright"><a href="media/63b0e0be.danlubarsky-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/danlubarsky-fb.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67928" decoding="async" loading="lazy" class="wp-image-67928" src="media/63b0e0be.danlubarsky-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/danlubarsky-fb.png" alt="" width="251" height="248" /></a><p id="caption-attachment-67928" class="wp-caption-text">Dan Lubarsky&#8217;s Facebook page, just prior to the March 8 story about Radaris, said he was from Moscow.</p></div>
<p>We took Mr. Gurvits&#8217; word on the ethnicity of his clients, and adjusted the story to remove a single mention that they were Russian. We did so even though Dan Lubarsky&#8217;s own Facebook page said (until recently) that he was from Moscow, Russia.</p>
<p>KrebsOnSecurity asked Mr. Gurvits to explain precisely which other details in the story were incorrect, and replied that we would be happy to update the story with a correction if they could demonstrate any errors of fact or omission.</p>
<p>We also requested specifics about several aspects of the story, such as the identity of the current Radaris CEO &#8212; <a href="https://radaris.com/page/about-company#team" target="_blank" rel="noopener">listed on the Radaris website</a> as &#8220;Victor K.&#8221; Mr. Gurvits replied that Radaris is and always has been based in Ukraine, and that the company&#8217;s true founder &#8220;Eugene L&#8221; is based there.</p>
<p>While Radaris has claimed to have offices in Massachusetts, Cyprus and Latvia, its website has never mentioned Ukraine. Mr. Gurvits has not responded to requests for more information about the identities of &#8220;Eugene L&#8221; or &#8220;Victor K.&#8221;</p>
<p>Gurvits said he had no intention of doing anyone&#8217;s reporting for them, and that the Lubarskys were going to sue KrebsOnSecurity for defamation unless the story was retracted in full. KrebsOnSecurity replied that journalists often face challenges to things that they report, but it is more than rare for one who makes a challenge to take umbrage at being asked for supporting information.</p>
<p>On June 13, Mr. Gurvits <a href="media/085b5b0f.Letter-to-Mr.-Krebs-w-Exhibits-6-13-24-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/Letter-to-Mr.-Krebs-w-Exhibits-6-13-24-1.pdf" target="_blank" rel="noopener">sent another letter</a> (PDF) that continued to claim KrebsOnSecurity was defaming his clients, only this time Gurvits said his clients would be satisfied if KrebsOnSecurity just removed their names from the story.</p>
<p>&#8220;Ultimately, my clients don’t care what you say about any of the websites or corporate entities in your Article, as long as you completely remove my clients’ names from the Article and cooperate with my clients to have copies of the Article where my clients’ names appear removed from the Internet,&#8221; Mr. Gurvits wrote.</p>
<h2>MEET THE FAKE RADARIS CEO</h2>
<p>The June 13 letter explained that the name Gary Norden was a pseudonym invented by the Radaris marketing division, but that neither of the Lubarsky brothers were Norden.</p>
<p>This was a startling admission, given that Radaris has quoted the fictitious Gary Norden in press releases published and paid for by Radaris, and in news media stories where the company is explicitly seeking money from investors. In other words, Radaris has been misrepresenting itself to investors from the beginning. Here&#8217;s a press release from Radaris that was published on PR Newswire in April 2011:</p>
<div id="attachment_67809" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67809" decoding="async" loading="lazy" class=" wp-image-67809" src="media/3c0ac9c5.GaryNordenRadarisPressRelease.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/GaryNordenRadarisPressRelease.png" alt="" width="751" height="514" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/06/GaryNordenRadarisPressRelease.png 1191w, https://krebsonsecurity.com/wp-content/uploads/2024/06/GaryNordenRadarisPressRelease-768x526.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/06/GaryNordenRadarisPressRelease-782x535.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-67809" class="wp-caption-text">A press release published by Radaris in 2011 names the CEO of Radaris as Gary Norden, which was a fake name made up by Radaris&#8217; marketing department.</p></div>
<p>In April 2014, the <em>Boston Business Journal</em> <a href="media/43ecfce7._hundreds_in_Mass._launch_VC_round_-_Boston_Business_Journal.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/People-search_tech_company_Radaris_to_hire_hundreds_in_Mass._launch_VC_round_-_Boston_Business_Journal.pdf" target="_blank" rel="noopener">published a story</a> (PDF) about Radaris that extolled the company&#8217;s rapid growth and considerable customer base. The story noted that, &#8220;to date, the company has raised less than $1 million from Cyprus-based investment company <strong>Difive</strong>.&#8221;</p>
<p>&#8220;We live in a world where information becomes much more broad and much more available every single day,&#8221; the Boston Business Journal quoted Radaris&#8217; fake CEO Gary Norden, who by then had somehow been demoted from CEO to vice president of business development.</p>
<div id="attachment_67826" style="width: 704px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67826" decoding="async" loading="lazy" class="size-full wp-image-67826" src="media/f05578d6.bostonbizjournal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/bostonbizjournal.png" alt="" width="694" height="738" /><p id="caption-attachment-67826" class="wp-caption-text">A Boston Business Journal story from April 2014 quotes the fictitious Radaris CEO Gary Norden.</p></div>
<p>&#8220;We decided there needs to be a service that allows for ease of monitoring of information about people,&#8221; the fake CEO said. The story went on to say Radaris was seeking to raise between $5 million and $7 million from investors in the ensuing months.<span id="more-67806"></span></p>
<h2>THE BIG LUBARSKY</h2>
<p>In his most recent demand letter, Mr. Gurvits helpfully included resumes for both of the Lubarsky brothers.</p>
<p>Gary/Dmitry Lubarsky&#8217;s resume states he is the owner of <strong>Difive.com</strong>, a startup incubator for IT companies. Recall that Difive is the same company mentioned by the fake Radaris CEO in the 2014 Boston Business Journal story, which said Difive was the company&#8217;s initial and sole investor.</p>
<p>Difive&#8217;s website in 2016 <a href="https://web.archive.org/web/20161114101156/http://www.difive.com/" target="_blank" rel="noopener">said</a> it had offices in Boston, New York, San Francisco, Riga (Latvia) and Moscow (nothing in Ukraine). Meanwhile, <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> reports difive.com was originally registered in 2007 to the fictitious Gary Norden from Massachusetts.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67812" src="media/9fbae2a9.di5.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/di5.png" alt="" width="749" height="376" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/06/di5.png 1455w, https://krebsonsecurity.com/wp-content/uploads/2024/06/di5-768x385.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/06/di5-782x392.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Archived copies of the Difive website from 2017 include <a href="https://web.archive.org/web/20161107220757/http://www.difive.com/portfolio.html" target="_blank" rel="noopener">a &#8220;Portfolio&#8221; page</a> indexing all of the companies in which Difive has invested. That list, <a href="https://krebsonsecurity.com/wp-content/uploads/2024/06/difiveportfolio.txt" target="_blank" rel="noopener">available here</a>, includes virtually every &#8220;Gary Norden&#8221; domain name mentioned in my original report, plus a few that escaped notice earlier.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67811" src="media/23cf9d9d.difive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/difive.png" alt="" width="749" height="519" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/06/difive.png 1225w, https://krebsonsecurity.com/wp-content/uploads/2024/06/difive-768x532.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/06/difive-782x541.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/06/difive-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Dan Lubarsky&#8217;s resume says he was CEO of a people search company called <strong>HumanBook</strong>. The Wayback machine at archive.org shows the Humanbook domain (<strong>humanbook.com</strong>) came online around <a href="https://web.archive.org/web/20080402030722/http://www.humanbook.com/" target="_blank" rel="noopener">April 2008</a>, when the company was still in &#8220;beta&#8221; mode.</p>
<p>By August 2008, however, humanbook.com had <a href="https://web.archive.org/web/20081118132852/http://www.humanbook.com/" target="_blank" rel="noopener">changed the name</a> advertised on its homepage to <strong>Radaris Beta</strong>. Eventually, Humanbook simply redirected to radaris.com.</p>
<div id="attachment_67827" style="width: 759px" class="wp-caption aligncenter"><a href="media/d962e587.humanbook-radaris.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/humanbook-radaris.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67827" decoding="async" loading="lazy" class="wp-image-67827" src="media/d962e587.humanbook-radaris.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/humanbook-radaris.png" alt="" width="749" height="469" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/06/humanbook-radaris.png 1179w, https://krebsonsecurity.com/wp-content/uploads/2024/06/humanbook-radaris-768x481.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/06/humanbook-radaris-782x489.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-67827" class="wp-caption-text">Archive.org&#8217;s record of humanbook.com from 2008, just after its homepage changed to Radaris Beta.</p></div>
<p>Astute readers may notice that the domain radaris.com is not among <a href="https://krebsonsecurity.com/wp-content/uploads/2024/06/difiveportfolio.txt" target="_blank" rel="noopener">the companies listed as Difive investments</a>. However, passive domain name system (DNS) records from DomainTools show that between October 2023 and March 2024 radaris.com was hosted alongside all of the other Gary Norden domains at the Internet address range <strong>38.111.228.x</strong>.</p>
<p>That address range simultaneously hosted every domain mentioned in this story and in the original March 2024 report as connected to email addresses used by Gary Norden, including radaris.com, radaris.ru, radaris.de, difive.com, privet.ru, blog.ru, comfi.com, phoneowner.com, russianamerica.com, eprofit.com, rehold.com, homeflock.com, humanbook.com and dozens more. A spreadsheet of those historical DNS entries for radaris.com is available <a href="https://krebsonsecurity.com/wp-content/uploads/2024/06/38-111-228-x-1.csv" target="_blank" rel="noopener">here</a> (.csv).</p>
<div id="attachment_67877" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67877" decoding="async" loading="lazy" class=" wp-image-67877" src="media/6ebbd73e.38-111-228-x.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/38-111-228-x.png" alt="" width="750" height="399" /><p id="caption-attachment-67877" class="wp-caption-text">Image: DomainTools.com</p></div>
<p>The breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> finds just two email addresses ending in difive.com have been exposed in data breaches over the years: dan@difive.com, and <strong>gn@difive.com</strong>. Presumably, &#8220;gn&#8221; stands for Gary Norden.</p>
<p>A search on the email address gn@difive.com via the breach tracking service <strong>osint.industries</strong> reveals this address was used to create an account at <strong>Airbnb</strong> under the name Gary, with the last four digits of the account&#8217;s phone number ending in &#8220;<strong>0001</strong>.&#8221;</p>
<p>Constella Intelligence finds gn@difive.com was associated with the Massachusetts number <strong>617-794-0001</strong>, which was used to register accounts for &#8220;Igor Lybarsky&#8221; from Wellesley or Sherborn, Ma. at multiple online businesses, including <strong>audiusa.com</strong> and the designer eyewear store <strong>luxottica.com</strong>.</p>
<p>The phone number 617-794-0001 also appears for a &#8220;Gary Nard&#8221; user at russianamerica.com. Igor Lubarsky&#8217;s resume says he was the manager of russianamerica.com.</p>
<p>DomainTools finds 617-794-0001 is connected to registration records for three domains, including <strong>paytone.com</strong>, a domain that Dan Lubarsky&#8217;s resume says he managed. DomainTools also found that number on the registration records for <a href="https://www.bbb.org/us/ak/anchorage/profile/information-bureaus/trustoria-1296-1000113354">trustoria.com</a>, another major consumer data broker that has an atrocious reputation, according to the <strong>Better Business Bureau</strong>.</p>
<p>Dan Lubarsky&#8217;s resume says he was responsible for several international telecommunications services, including the website <strong>comfi.com</strong>. DomainTools says the phone number connected to that domain &#8212; 617-952-4234 &#8212; was also used on the registration records for <strong>humanbook.net/biz/info/mobi/us</strong>, as well as for <strong>radaris.me</strong>, <strong>radaris.in</strong>, and <strong>radaris.tel</strong>.</p>
<p>Two other key domains are connected to that phone number. The first is <strong>b</strong><strong>arsky.com</strong>, which is the website for <a href="https://www.sherbornma.org/DocumentCenter/View/921/Decision-of-the-Zoning-Board-of-Appeals-PDF" target="_blank" rel="noopener">Barsky Estate Realty Trust</a> (PDF), a real estate holding company controlled by the Lubarskys. Naturally, DomainTools finds barsky.com also was registered to a Gary Norden from Massachusetts. But the organization listed in the barsky.com registration records is <strong>Comfi Inc.</strong>, a VOIP communications firm that Dan Lubarsky&#8217;s resume says he managed.</p>
<p>The other domain of note is unipointtechnologies.com. Dan Lubarsky&#8217;s resume says he was the CEO of Wellesley Hills, Mass-based <strong>Unipoint Technology Inc. </strong>In 2012, Unipoint was <a href="https://www.fcc.gov/document/unipoint-technologies-notice-apparent-liability-forfeiture" target="_blank" rel="noopener">fined $179,000</a> by the <strong>U.S. Federal Communications Commission</strong>, which said the company had failed to apply for a license to provide international telecommunications services.</p>
<h2>PATENTLY REMARKABLE</h2>
<p>The <a href="media/6125edb5.GaryNordenRadarisPressRelease-782x535.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/GaryNordenRadarisPressRelease-782x535.png" target="_blank" rel="noopener">2011 Radaris press release</a> quoting their fake CEO Gary Norden said the company had four patents pending from a team of computer science PhDs. According to the resume shared by Mr. Gurvits, Dan Lubarsky has a PhD in computer science.</p>
<p>The <strong>U.S. Patent and Trademark Office</strong> (PTO) says Dan Lubarsky/Lubarski has <a href="https://patents.justia.com/inventor/dan-lubarski" target="_blank" rel="noopener">at least nine technology patents to his name</a>. The fake CEO press release from Radaris mentioning its four patents was published in April 2011. By that time, the PTO says Dan Lubarsky had applied for exactly four patents, including, &#8220;<a href="https://ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20090171979" target="_blank" rel="noopener">System and Method for a Web-Based People Directory</a>.&#8221; The first of those patents, published in 2009, is <a href="https://ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20090171691" target="_blank" rel="noopener">tied to Humanbook.com</a>, the company Dan Lubarsky founded that later changed its name to Radaris.</p>
<p>If the Lubarskys were never involved in Radaris, how do they or their attorney know the inside information that Gary Norden is a fiction of Radaris&#8217; marketing department? KrebsOnSecurity has learned that Mr. Gurvits is the same attorney responding on behalf of Radaris in <a href="https://trellis.law/case/34023/midl000847-24/atlas-data-privacy-c-orporatio-vs-radaris-llc" target="_blank" rel="noopener">a lawsuit against the data broker</a> filed earlier this year by <strong>Atlas Data Privacy</strong>.</p>
<p>Mr. Gurvits also stepped forward as Radaris&#8217; attorney in <a href="https://www.courtlistener.com/docket/5969712/huebner-v-radaris-llc/" target="_blank" rel="noopener">a class action lawsuit the company lost in 2017</a> because it never contested the claim in court. When the plaintiffs told the judge they couldn&#8217;t collect on the $7.5 million default judgment, the judge ordered the domain registry Verisign to transfer the radaris.com domain name to the plaintiffs.</p>
<p>Mr. Gurvits appealed the verdict, arguing that the lawsuit hadn&#8217;t named the actual owners of the Radaris domain name &#8212; a Cyprus company called <strong>Bitseller Expert Limited</strong> &#8212; and thus taking the domain away would be a violation of their due process rights.</p>
<p>The judge ruled in Radaris&#8217; favor &#8212; halting the domain transfer &#8212; and told the plaintiffs they could refile their complaint. Soon after, the operator of Radaris changed from Bitseller to <strong>Andtop Company</strong>, an entity <a href="media/9dbb566e.Andtop.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/Andtop.pdf" target="_blank" rel="noopener">formed</a> (PDF) in the <a href="https://en.wikipedia.org/wiki/Marshall_Islands" target="_blank" rel="noopener">Marshall Islands</a> in Oct. 2020. Andtop also operates the aforementioned people-search service Trustoria.</p>
<p>Mr. Gurvits&#8217; most-publicized defamation case was a client named <strong>Aleksej Gubarev</strong>, a Russian technology executive whose name appeared in the <a href="https://en.wikipedia.org/wiki/Steele_dossier" target="_blank" rel="noopener">Steele Dossier</a>. That document included a collection of salacious, unverified information gathered by the former British intelligence officer Christopher Steele during the 2016 U.S. presidential campaign at the direction of former president Donald Trump&#8217;s political rivals.</p>
<p>Gubarev, the head of the IT services company <strong>XBT Holding</strong> and the Florida web hosting firm <strong>Webzilla</strong>, sued <strong>BuzzFeed</strong> for publishing the Steele dossier. <a href="https://www.rferl.org/a/methbot-russia-internet-fraud-state-sponsored-hacking-zhukov/31241417.html" target="_blank" rel="noopener">One of the items</a> in the dossier alleged that XBT/Webzilla and affiliated companies played a key role in the hack of Democratic Party computers in the spring of 2016. The memo alleged Gubarev had been coerced into providing services to Russia’s main domestic security agency, known as the FSB.</p>
<p>In December 2018, a federal judge in Miami <a href="https://www.nytimes.com/2018/12/19/business/media/buzzfeed-dossier-lawsuit-trump-steele-russia.html" target="_blank" rel="noopener">ruled in favor of BuzzFeed</a>, saying the publication was protected by the fair report privilege, which gives news organizations latitude in reporting on official government proceedings.</p>
<p>Radaris was originally operated by Bitseller Expert Limited. Who owns Bitseller Expert Limited? <a href="media/6401c766.BEL-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/BEL-1.pdf" target="_blank" rel="noopener">A report</a> (PDF) obtained from the Cyprus business registry shows this company lists its director as <strong>Pavel Kaydash</strong> from Moscow. Mr. Kaydash could not be reached for comment.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-67818" src="media/79df01d8.bitsellerexpertlimited.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/bitsellerexpertlimited.png" alt="" width="749" height="647" /></p>


feed_id: https://krebsonsecurity.com/?p=67939
title: The Not-So-Secret Network Access Broker x999xx
uri: The-Not-So-Secret-Network-Access-Broker-x999xx
url: https://krebsonsecurity.com/2024/07/the-not-so-secret-network-access-broker-x999xx/
content:
<p><img decoding="async" class=" wp-image-58061 aligncenter" src="media/f572f658.wbrkb.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/wbrkb.jpg" alt="" width="750" height="501" /></p>
<p>Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is &#8220;<strong>x999xx</strong>,&#8221; the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.</p>
<p>x999xx is a well-known &#8220;access broker&#8221; who frequently sells access to hacked corporate networks &#8212; usually in the form of remote access credentials &#8212; as well as compromised databases containing large amounts of personal and financial data.</p>
<p>In an analysis published in February 2019, cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> called x999xx one of the most senior and prolific members of the top-tier Russian-language cybercrime forum <strong>Exploit</strong>, where x999xx could be seen frequently advertising the sale of stolen databases and network credentials.</p>
<p>In August 2023, x999xx sold access to a company that develops software for the real estate industry. In July 2023, x999xx advertised the sale of Social Security numbers, names, and birthdays for the citizenry of an entire U.S. state (unnamed in the auction).</p>
<p>A month earlier, x999xx posted a sales thread for 80 databases taken from Australia&#8217;s largest retail company. &#8220;You may use this data to demand a ransom or do something different with it,&#8221; x999xx wrote on Exploit. &#8220;Unfortunately, the flaw was patched fast. [+] no one has used the data yet [+] the data hasn&#8217;t been used to send spam [+] the data is waiting for its time.&#8221;</p>
<p>In October 2022, x999xx sold administrative access to a U.S. healthcare provider.<span id="more-67939"></span></p>
<h2>ALIAS: MAXNM</h2>
<p>The oldest account by the name x999xx appeared in 2009 on the Russian language cybercrime forum <strong>Verified</strong>, under the email address <strong>maxnm@ozersk.com</strong>. Ozersk is a city in the Chelyabinsk region of west-central Russia.</p>
<p>According to the breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a>, the address maxnm@ozersk.com was used more than a decade ago to create an account at <strong>Vktontakte</strong> (the Russian answer to Facebook) under the name <strong>Maxim Kirtsov</strong> from Ozersk. Mr. Kirtsov&#8217;s profile &#8212; &#8220;<strong>maxnm</strong>&#8221; &#8212; says his birthday is September 5, 1991.</p>
<div id="attachment_67945" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67945" decoding="async" loading="lazy" class=" wp-image-67945" src="media/d17c1601.kirtsov-photos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/kirtsov-photos.png" alt="" width="750" height="710" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/kirtsov-photos.png 808w, https://krebsonsecurity.com/wp-content/uploads/2024/07/kirtsov-photos-768x727.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/kirtsov-photos-782x740.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67945" class="wp-caption-text">Personal photos Maxnm shared on Vktontakte in 2016. The caption has been machine translated from Russian.</p></div>
<p>The user x999xx registered on the Russian language cybercrime community <strong>Zloy</strong> in 2014 using the email address <strong>maxnmalias-1@yahoo.com</strong>. Constella says this email address was used in 2022 at the Russian shipping service <strong>cdek.ru</strong> in by a <strong>Maksim Georgievich Kirtsov</strong> from Ozersk.</p>
<p>Additional searches on these contact details reveal that prior to 2009, x999xx favored the handle Maxnm on Russian cybercrime forums. Cyber intelligence company <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> finds the user Maxnm registered on Zloy in 2006 from an Internet address in Chelyabinsk, using the email address <strong>kirtsov@telecom.ozersk.ru</strong>.</p>
<p>That same email address was used to create Maxnm accounts on several other crime forums, including <strong>Spamdot</strong> and <strong>Exploit</strong> in 2005 (also from Chelyabinsk), and <strong>Damagelab</strong> in 2006.</p>
<p>A search in Constella for the Russian version of Kirtsov&#8217;s full name &#8212; <strong>Кирцов Максим Георгиевич</strong> &#8212; brings up multiple accounts registered to <strong>maksya@icloud.com</strong>.</p>
<p>A review of the digital footprint for maksya@icloud.com at <strong>osint.industries</strong> reveals this address was used a decade ago to register a still-active account at <strong>imageshack.com</strong> under the name x999xx. That account features numerous screenshots of financial statements from various banks, chat logs with other hackers, and even hacked websites.</p>
<div id="attachment_67948" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67948" decoding="async" loading="lazy" class=" wp-image-67948" src="media/bd31b546.x999xx-imageshack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-imageshack.png" alt="" width="750" height="431" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-imageshack.png 1436w, https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-imageshack-768x442.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-imageshack-782x450.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67948" class="wp-caption-text">x999xx&#8217;s Imageshack account includes screenshots of bank account balances from dozens of financial institutions, as well as chat logs with other hackers and pictures of homegrown weed.</p></div>
<p>Some of the photos in that Imageshack account also appear on Kirtsov&#8217;s Vkontakte page, including images of vehicles he owns, as well as pictures of potted marijuana plants. Kirtsov&#8217;s Vkontakte profile says that in 2012 he was a faculty member of the <strong>Ozersk Technological Institute National Research Nuclear University</strong>.</p>
<p>The Vkontakte page lists Kirtsov&#8217;s occupation as a website called <strong>ozersk[.]today</strong>, which on the surface appears to be a blog about life in Ozersk. However, in 2019 the security firm <strong>Recorded Future</strong> published <a href="https://www.recordedfuture.com/blog/cobalt-strike-servers" target="_blank" rel="noopener">a blog post</a> which found this domain was being used to host a malicious <strong>Cobalt Strike</strong> server.</p>
<p>Cobalt Strike is a commercial network penetration testing and reconnaissance tool that is sold only to vetted partners. But stolen or ill-gotten Cobalt Strike licenses are frequently abused by cybercriminal gangs to help lay the groundwork for the installation of ransomware on a victim network.</p>
<p>In August 2023, x999xx posted a message on Exploit saying he was interested in buying a licensed version of Cobalt Strike. A month earlier, x999xx filed a complaint on Exploit against another forum member named <strong>Cobaltforce</strong>, an apparent onetime partner whose sudden and prolonged disappearance from the community left x999xx and others in the lurch. Cobaltforce recruited people experienced in using Cobalt Strike for ransomware operations, and offered to monetize access to hacked networks for a share of the profits.</p>
<p><a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> finds ozersk[.]today was registered to the email address <strong>dashin2008@yahoo.com</strong>, which also was used to register roughly two dozen other domains, including <strong>x999xx[.]biz</strong>. Virtually all of those domains were registered to Maxim Kirtsov from Ozersk. Below is a mind map used to track the identities mentioned in this story.</p>
<div id="attachment_67961" style="width: 760px" class="wp-caption aligncenter"><a href="media/cb8ab960.x999xx-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67961" decoding="async" loading="lazy" class="wp-image-67961 " src="media/cb8ab960.x999xx-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-mm.png" alt="" width="750" height="378" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-mm.png 1455w, https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-mm-768x387.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/x999xx-mm-782x394.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-67961" class="wp-caption-text">A visual depiction of the data points connecting x999xx to Max Kirtsov.</p></div>
<p>x999xx is a prolific member of the Russian webmaster forum &#8220;Gofuckbiz,&#8221; with more than 2,000 posts over nearly a decade, according to Intel 471. In one post from 2016, x999xx asked whether anyone knew where he could buy a heat lamp that simulates sunlight, explaining that one his pet rabbits had recently perished for lack of adequate light and heat. Mr. Kirtsov&#8217;s Vkontakte page includes several pictures of caged rabbits from 2015 and earlier.</p>
<h2>CONFIRMATION</h2>
<p>Reached via email, Mr. Kirtsov acknowledged that he is x999xx. Kirtsov said he and his team are also regular readers of KrebsOnSecurity.</p>
<p>&#8220;We&#8217;re glad to hear and read you,&#8221; Kirtsov replied.</p>
<p>Asked whether he was concerned about the legal and moral implications of his work, Kirtsov downplayed his role in ransomware intrusions, saying he was more focused on harvesting data.</p>
<p>&#8220;I consider myself as committed to ethical practices as you are,&#8221; Kirtsov wrote. &#8220;I have also embarked on research and am currently mentoring students. You may have noticed my activities on a forum, which I assume you know of through information gathered from public sources, possibly using the new tool you reviewed.&#8221;</p>
<p>&#8220;Regarding my posts about selling access, I must honestly admit, upon reviewing my own actions, I recall such mentions but believe they were never actualized,&#8221; he continued. &#8220;Many use the forum for self-serving purposes, which explains why listings of targets for sale have dwindled &#8212; they simply ceased being viable.&#8221;</p>
<p>Kirtsov asserted that he is not interested in harming healthcare institutions, just in stealing their data.</p>
<p>&#8220;As for health-related matters, I was once acquainted with affluent webmasters who would pay up to $50 for every 1000 health-themed emails,&#8221; Kirtsov said. &#8220;Therefore, I had no interest in the more sensitive data from medical institutions like X-rays, insurance numbers, or even names; I focused solely on emails. I am proficient in SQL, hence my ease with handling data like IDs and emails. And i never doing spam or something like this.&#8221;</p>
<p>On the Russian crime forums, x999xx said he never targets anything or anyone in Russia, and that he has little to fear from domestic law enforcement agencies provided he remains focused on foreign adversaries.</p>
<p>x999xx&#8217;s lackadaisical approach to personal security mirrors that of <strong>Wazawaka</strong>, another top Russian access broker who sold access to countless organizations and even operated his own ransomware affiliate programs.</p>
<p>&#8220;Don’t shit where you live, travel local, and don’t go abroad,&#8221; Wazawaka said of his own personal mantra. &#8220;Mother Russia will help you. Love your country, and you will always get away with everything.&#8221;</p>
<p>In January 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">followed clues left behind by Wazawaka</a> to identify him as 32-year-old <strong>Mikhail Matveev</strong> from Khakassia, Russia. In May 2023, the <strong>U.S. Department of Justice</strong> <a href="https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/" target="_blank" rel="noopener">indicted Matveev</a> as a key figure in several ransomware groups that collectively extorted hundreds of millions of dollars from victim organizations. The <b>U.S. State Department</b><strong> </strong>is offering <a href="https://www.state.gov/the-department-of-state-announces-reward-offer-against-russian-ransomware-actor/" target="_blank" rel="noopener">a $10 million reward</a> for information leading to the capture and/or prosecution of Matveev.</p>
<p>Perhaps in recognition that many top ransomware criminals are largely untouchable so long as they remain in Russia, western law enforcement agencies have begun focusing more on getting inside the heads of those individuals. These so-called &#8220;<a href="https://www.wired.com/story/cop-cybercriminal-hacker-psyops/" target="_blank" rel="noopener">psyops</a>&#8221; are aimed at infiltrating ransomware-as-a-service operations, disrupting major cybercrime services, and decreasing trust within cybercriminal communities.</p>
<p>When authorities in the U.S. and U.K. announced in February 2024 that they’d <a href="https://krebsonsecurity.com/2024/02/feds-seize-lockbit-ransomware-websites-offer-decryption-tools-troll-affiliates/" target="_blank" rel="noopener">infiltrated and seized</a> the infrastructure used by the infamous <strong>LockBit</strong> ransomware gang, they borrowed the existing design of LockBit’s victim shaming website to link instead to press releases about the takedown, and included a countdown timer that was eventually replaced with the personal details of <a href="https://krebsonsecurity.com/2024/05/how-did-authorities-identify-the-alleged-lockbit-boss/" target="_blank" rel="noopener">LockBit’s alleged leader</a>.</p>
<p>In May 2024, law enforcement agencies in the United States and Europe announced <a href="https://krebsonsecurity.com/2024/05/operation-endgame-hits-malware-delivery-platforms/" target="_blank" rel="noopener">Operation Endgame</a>, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. The Operation Endgame website also included a countdown timer, which served to tease the release of several animated videos that mimic the same sort of flashy, short advertisements that established cybercriminals often produce to promote their services online.</p>


feed_id: https://krebsonsecurity.com/?p=68011
title: Microsoft Patch Tuesday, July 2024 Edition
uri: Microsoft-Patch-Tuesday-July-2024-Edition
url: https://krebsonsecurity.com/2024/07/microsoft-patch-tuesday-july-2024-edition/
content:
<p><strong>Microsoft Corp.</strong> today issued software updates to plug at least 139 security holes in various flavors of <strong>Windows</strong> and other Microsoft products. Redmond says attackers are already exploiting at least two of the vulnerabilities in active attacks against Windows users.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The first Microsoft zero-day this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38080" target="_blank" rel="noopener">CVE-2024-38080</a>, a bug in the <strong>Windows Hyper-V</strong> component that affects <strong>Windows 11</strong> and <strong>Windows Server 2022</strong> systems. CVE-2024-38080 allows an attacker to increase their account privileges on a Windows machine. Although Microsoft says this flaw is being exploited, it has offered scant details about its exploitation.</p>
<p>The other zero-day is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38112" target="_blank" rel="noopener">CVE-2024-38112</a>, which is a weakness in <strong>MSHTML</strong>, the proprietary engine of Microsoft&#8217;s <strong>Internet Explorer</strong> web browser. <strong>Kevin Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>, said exploitation of CVE-2024-38112 likely requires the use of an “attack chain” of exploits or programmatic changes on the target host, a la Microsoft&#8217;s description: “Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.”</p>
<p>&#8220;Despite the lack of details given in the initial advisory, this vulnerability affects all hosts from <strong>Windows Server 2008 R2</strong> onwards, including clients,&#8221; Breen said. &#8220;Due to active exploitation in the wild this one should be prioritized for patching.&#8221;</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, called special attention to <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38021" target="_blank" rel="noopener">CVE-2024-38021</a>, a remote code execution flaw in <strong>Microsoft Office</strong>. Attacks on this weakness would lead to the disclosure of NTLM hashes, which could be leveraged as part of an NTLM relay or “pass the hash” attack, which lets an attacker masquerade as a legitimate user without ever having to log in.</p>
<p>&#8220;One of the more successful attack campaigns from 2023 used CVE-2023-23397, an elevation of privilege bug in Microsoft Outlook that could also leak NTLM hashes,&#8221; Narang said. &#8220;However, CVE-2024-38021 is limited by the fact that the Preview Pane is not an attack vector, which means that exploitation would not occur just by simply previewing the file.&#8221;</p>
<p>The security firm <strong>Morphisec</strong>, credited with reporting CVE-2024-38021 to Microsoft, said it respectfully disagrees with Microsoft&#8217;s &#8220;important&#8221; severity rating, arguing the Office flaw deserves a more dire &#8220;critical&#8221; rating given how easy it is for attackers to exploit.</p>
<p>&#8220;Their assessment differentiates between trusted and untrusted senders, noting that while the vulnerability is zero-click for trusted senders, it requires one click user interaction for untrusted senders,&#8221; Morphisec&#8217;s <strong>Michael Gorelik</strong> said in <a href="https://blog.morphisec.com/cve-2024-38021-microsoft-outlook-moniker-rce-vulnerability" target="_blank" rel="noopener">a blog post about their discovery</a>. &#8220;This reassessment is crucial to reflect the true risk and ensure adequate attention and resources are allocated for mitigation.&#8221;</p>
<p>In last month&#8217;s Patch Tuesday, Microsoft fixed a flaw in its Windows WiFi driver that attackers could use to install malicious software just by sending a vulnerable Windows host a specially crafted data packet over a local network. <strong>Jason Kikta</strong> at <strong>Automox</strong> said this month&#8217;s CVE-2024-38053 &#8212; a security weakness in <strong>Windows Layer Two Bridge Network</strong> &#8212; is another local network &#8220;ping-of-death&#8221; vulnerability that should be a priority for road warriors to patch.<span id="more-68011"></span></p>
<p>&#8220;This requires close access to a target,&#8221; Kikta said. &#8220;While that precludes a ransomware actor in Russia, it is something that is outside of most current threat models. This type of exploit works in places like shared office environments, hotels, convention centers, and anywhere else where unknown computers might be using the same physical link as you.&#8221;</p>
<p>Automox also highlighted three vulnerabilities in Windows Remote Desktop a service that allocates Client Access Licenses (CALs) when a client connects to a remote desktop host (<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38077" target="_blank" rel="noopener">CVE-2024-38077</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38074" target="_blank" rel="noopener">CVE-2024-38074</a>, and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38076" target="_blank" rel="noopener">CVE-2024-38076</a>). All three bugs have been assigned a CVSS score of 9.8 (out of 10) and indicate that a malicious packet could trigger the vulnerability.</p>
<p><strong>Tyler Reguly</strong> at <strong>Forta</strong> noted that today marks the End of Support date for <strong>SQL Server 2014</strong>, a platform that according to Shodan still has ~110,000 instances publicly available. On top of that, more than a quarter of all vulnerabilities Microsoft fixed this month are in SQL server.</p>
<p>&#8220;A lot of companies don’t update quickly, but this may leave them scrambling to update those environments to supported versions of MS-SQL,&#8221; Reguly said.</p>
<p>It’s a good idea for Windows end-users to stay current with security updates from Microsoft, which can quickly pile up otherwise. That doesn’t mean you have to install them on Patch Tuesday. Indeed, waiting a day or three before updating is a sane response, given that sometimes updates go awry and usually within a few days Microsoft has fixed any issues with its patches. It’s also smart to back up your data and/or image your Windows drive before applying new updates.</p>
<p>For a more detailed breakdown of the individual flaws addressed by Microsoft today, check out the <a href="https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20July%202024/31058" target="_blank" rel="noopener">SANS Internet Storm Center’s list</a>. For those admins responsible for maintaining larger Windows environments, it often pays to keep an eye on <a href="https://www.askwoody.com/" target="_blank" rel="noopener">Askwoody.com</a>, which frequently points out when specific Microsoft updates are creating problems for a number of users.</p>
<p>As ever, if you experience any problems applying any of these updates, consider dropping a note about it in the comments; chances are decent someone else reading here has experienced the same issue, and maybe even has a solution.</p>


feed_id: https://krebsonsecurity.com/?p=67973
title: The Stark Truth Behind the Resurgence of Russia’s Fin7
uri: The-Stark-Truth-Behind-the-Resurgence-of-Russia-s-Fin7
url: https://krebsonsecurity.com/2024/07/the-stark-truth-behind-the-resurgence-of-russias-fin7/
content:
<p>The Russia-based cybercrime group dubbed &#8220;<strong>Fin7</strong>,&#8221; known for phishing and malware attacks that have cost victim organizations an estimated $3 billion in losses since 2013, was declared dead last year by U.S. authorities. But experts say Fin7 has roared back to life in 2024 &#8212; setting up thousands of websites mimicking a range of media and technology companies &#8212; with the help of <strong>Stark Industries Solutions</strong>, a sprawling hosting provider that is a persistent source of cyberattacks against enemies of Russia.</p>
<p><a href="media/28380575.mitre-fin7.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/mitre-fin7.png" target="_blank" rel="noopener"><img decoding="async" class="aligncenter wp-image-67983" src="media/28380575.mitre-fin7.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/mitre-fin7.png" alt="" width="751" height="254" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/mitre-fin7.png 1397w, https://krebsonsecurity.com/wp-content/uploads/2024/07/mitre-fin7-768x259.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/mitre-fin7-782x264.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a></p>
<p>In May 2023, the U.S. attorney for Washington state <a href="https://www.justice.gov/usao-wdwa/pr/high-level-organizer-notorious-hacking-group-fin7-sentenced-ten-years-prison-scheme" target="_blank" rel="noopener">declared</a> &#8220;Fin7 is an entity no more,&#8221; after prosecutors secured convictions and prison sentences against three men found to be high-level Fin7 hackers or managers. This was a bold declaration against a group that the U.S. Department of Justice described as a criminal enterprise with more than 70 people organized into distinct business units and teams.</p>
<p>The first signs of Fin7&#8217;s revival came in April 2024, when <strong>Blackberry</strong> wrote about an intrusion at a large automotive firm that began with <a href="https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry" target="_blank" rel="noopener">malware served by a typosquatting attack</a> targeting people searching for a popular free network scanning tool.</p>
<p>Now, researchers at security firm <strong>Silent Push</strong> <a href="https://www.silentpush.com/blog/fin7/" target="_blank" rel="noopener">say</a> they have devised a way to map out Fin7&#8217;s rapidly regrowing cybercrime infrastructure, which includes more than 4,000 hosts that employ a range of exploits, from typosquatting and booby-trapped ads to malicious browser extensions and spearphishing domains.</p>
<p>Silent Push said it found Fin7 domains targeting or spoofing brands including <strong>American Express</strong>, <strong>Affinity Energy</strong>, <strong>Airtable</strong>, <strong>Alliant</strong>, <strong>Android Developer</strong>, <strong>Asana</strong>, <strong>Bitwarden</strong>, <strong>Bloomberg</strong>, <strong>Cisco (Webex)</strong>, <strong>CNN</strong>, <strong>Costco</strong>, <strong>Dropbox</strong>, <strong>Grammarly</strong>, <strong>Google,</strong> <strong>Goto.com</strong>, <strong>Harvard</strong>, <strong>Lexis Nexis</strong>, <strong>Meta</strong>, <strong>Microsoft 365</strong>, <strong>Midjourney</strong>, <strong>Netflix</strong>, <strong>Paycor</strong>, <strong>Quickbooks</strong>, <strong>Quicken</strong>, <strong>Reuters</strong>, <strong>Regions Bank Onepass</strong>, <strong>RuPay</strong>, <strong>SAP (Ariba)</strong>, <strong>Trezor</strong>, <strong>Twitter/X</strong>, <strong>Wall Street Journal</strong>, <strong>Westlaw</strong>, and <strong>Zoom</strong>, among others.</p>
<p><strong>Zach Edwards</strong>, senior threat analyst at Silent Push, said many of the Fin7 domains are innocuous-looking websites for generic businesses that sometimes include text from default website templates (the content on these sites often has nothing to do with the entity&#8217;s stated business or mission).</p>
<p>Edwards said Fin7 does this to &#8220;age&#8221; the domains and to give them a positive or at least benign reputation before they&#8217;re eventually converted for use in hosting brand-specific phishing pages.</p>
<p>&#8220;It took them six to nine months to ramp up, but ever since January of this year they have been humming, building a giant phishing infrastructure and aging domains,&#8221; Edwards said of the cybercrime group.</p>
<p>In typosquatting attacks, Fin7 registers domains that are similar to those for popular free software tools. Those look-alike domains are then advertised on Google so that sponsored links to them show up prominently in search results, which is usually above the legitimate source of the software in question.</p>
<div id="attachment_66174" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66174" decoding="async" loading="lazy" class=" wp-image-66174" src="media/df43a6ae.freecadad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad.png" alt="" width="750" height="532" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad.png 863w, https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad-768x545.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad-782x555.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/01/freecadad-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66174" class="wp-caption-text">A malicious site spoofing FreeCAD showed up prominently as a sponsored result in Google search results earlier this year.</p></div>
<p>According to Silent Push, the software currently being targeted by Fin7 includes <strong>7-zip</strong>, <strong>PuTTY</strong>, <strong>ProtectedPDFViewer</strong>, <strong>AIMP</strong>, <strong>Notepad++</strong>, <strong>Advanced IP Scanner</strong>, <strong>AnyDesk</strong>, <strong>pgAdmin</strong>, <strong>AutoDesk</strong>, <strong>Bitwarden</strong>, <strong>Rest Proxy</strong>, <strong>Python</strong>, <strong>Sublime Text</strong>, and <strong>Node.js</strong>.<span id="more-67973"></span></p>
<p>In May 2024, security firm <strong>eSentire</strong> <a href="https://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads" target="_blank" rel="noopener">warned</a> that Fin7 was spotted using sponsored Google ads to serve pop-ups prompting people to download phony browser extensions that install malware. <strong>Malwarebytes</strong> <a href="https://www.threatdown.com/blog/corporate-users-targeted-via-malicious-ads-and-modals/" target="_blank" rel="noopener">blogged about a similar campaign</a> in April, but did not attribute the activity to any particular group.</p>
<div id="attachment_67978" style="width: 759px" class="wp-caption aligncenter"><a href="media/82c61632.reutersbrowserextension.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/reutersbrowserextension.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-67978" decoding="async" loading="lazy" class="wp-image-67978" src="media/82c61632.reutersbrowserextension.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/reutersbrowserextension.png" alt="" width="749" height="403" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/reutersbrowserextension.png 1202w, https://krebsonsecurity.com/wp-content/uploads/2024/07/reutersbrowserextension-768x413.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/reutersbrowserextension-782x421.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/07/reutersbrowserextension-370x200.png 370w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-67978" class="wp-caption-text">A pop-up at a Thomson Reuters typosquatting domain telling visitors they need to install a browser extension to view the news content.</p></div>
<p>Edwards said Silent Push discovered the new Fin7 domains after a hearing from an organization that was targeted by Fin7 in years past and suspected the group was once again active. Searching for hosts that matched Fin7&#8217;s known profile revealed just one active site. But Edwards said that one site pointed to many other Fin7 properties at Stark Industries Solutions, a large hosting provider that materialized just two weeks before Russia invaded Ukraine.</p>
<p>As KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">wrote in May</a>, Stark Industries Solutions is being used as a staging ground for wave after wave of cyberattacks against Ukraine that have been tied to Russian military and intelligence agencies.</p>
<p>&#8220;FIN7 rents a large amount of dedicated IP on Stark Industries,&#8221; Edwards said. &#8220;Our analysts have discovered numerous Stark Industries IPs that are solely dedicated to hosting FIN7 infrastructure.&#8221;</p>
<p>Fin7 once famously operated behind fake cybersecurity companies &#8212; with names like <strong>Combi Security</strong> and <strong>Bastion Secure</strong> &#8212; which they used for <a href="https://therecord.media/cybercrime-gang-sets-up-fake-company-to-hire-security-experts-to-aid-in-ransomware-attacks" target="_blank" rel="noopener">hiring security experts</a> to aid in ransomware attacks. One of the new Fin7 domains identified by Silent Push is <strong>cybercloudsec[.]com</strong>, which promises to &#8220;grow your business with our IT, cyber security and cloud solutions.&#8221;</p>
<div id="attachment_67980" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67980" decoding="async" loading="lazy" class=" wp-image-67980" src="media/35fc4b33.cybseccloud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/cybseccloud.png" alt="" width="749" height="392" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/cybseccloud.png 1070w, https://krebsonsecurity.com/wp-content/uploads/2024/07/cybseccloud-768x402.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/cybseccloud-782x409.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/07/cybseccloud-267x140.png 267w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-67980" class="wp-caption-text">The fake Fin7 security firm Cybercloudsec.</p></div>
<p>Like other phishing groups, Fin7 seizes on current events, and at the moment it is targeting tourists visiting France for the Summer Olympics later this month. Among the new Fin7 domains Silent Push found are several sites phishing people seeking tickets at <a href="https://www.louvre.fr/en" target="_blank" rel="noopener">the Louvre</a>.</p>
<p>&#8220;We believe this research makes it clear that Fin7 is back and scaling up quickly,&#8221; Edwards said. &#8220;It&#8217;s our hope that the law enforcement community takes notice of this and puts Fin7 back on their radar for additional enforcement actions, and that quite a few of our competitors will be able to take this pool and expand into all or a good chunk of their infrastructure.&#8221;</p>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">Stark Industries Solutions: An Iron Hammer in the Cloud</a>.</p>
<p><a href="media/39884cfb.Prodaft-2022-FIN7-Unveiled.pdf" data-original-source="https://www.ledecodeur.ch/wp-content/uploads/2022/12/Prodaft-2022-FIN7-Unveiled.pdf" target="_blank" rel="noopener">A 2022 deep dive on Fin7 from the Swiss threat intelligence firm Prodaft</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=68041
title: Crooks Steal Phone, SMS Records for Nearly All AT&T Customers
uri: Crooks-Steal-Phone-SMS-Records-for-Nearly-All-AT-T-Customers
url: https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/
content:
<p><strong>AT&amp;T Corp.</strong> disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people &#8212; nearly all of its customers. AT&amp;T said it delayed disclosing the incident in response to &#8220;national security and public safety concerns,&#8221; noting that some of the records included data that could be used to determine where a call was made or text message sent. AT&amp;T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed).</p>
<p><img decoding="async" class="aligncenter wp-image-63008" src="media/53743d64.attbldg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/attbldg.png" alt="" width="749" height="497" /></p>
<p>In <a href="https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm" target="_blank" rel="noopener">a regulatory filing</a> with the <strong>U.S. Securities and Exchange Commission</strong> today, AT&amp;T said cyber intruders accessed an AT&amp;T workspace on a third-party cloud platform in April, downloading files containing customer call and text interactions between May 1 and October 31, 2022, as well as on January 2, 2023.</p>
<p>The company said the stolen data includes records of calls and texts for mobile providers that resell AT&amp;T&#8217;s service, but that it does not include the content of calls or texts, Social Security numbers, dates of birth, or any other personally identifiable information.</p>
<p>However, the company said a subset of stolen records included information about the location of cellular communications towers closest to the subscriber, data that could be used to determine the approximate location of the customer device initiating or receiving those text messages or phone calls.</p>
<p>&#8220;While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number,&#8221; AT&amp;T allowed.</p>
<p>AT&amp;T&#8217;s said it learned of the breach on April 19, but delayed disclosing it at the request of federal investigators. The company&#8217;s SEC disclosure says at least one individual has been detained by the authorities in connection with the breach.</p>
<p>In a written statement shared with KrebsOnSecurity, the FBI confirmed that it asked AT&amp;T to delay notifying affected customers.</p>
<p>&#8220;Shortly after identifying a potential breach to customer data and before making its materiality decision, AT&amp;T contacted the FBI to report the incident,&#8221; the FBI statement reads. &#8220;In assessing the nature of the breach, all parties discussed a potential delay to public reporting under Item 1.05(c) of the SEC Rule, due to potential risks to national security and/or public safety. AT&amp;T, FBI, and DOJ worked collaboratively through the first and second delay process, all while sharing key threat intelligence to bolster FBI investigative equities and to assist AT&amp;T’s incident response work.&#8221;</p>
<p><a href="https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/?guccounter=1" target="_blank" rel="noopener">Techcrunch</a> quoted an AT&amp;T spokesperson saying the customer data was stolen as a result of a still-unfolding data breach involving more than 160 customers of the cloud data provider <strong>Snowflake</strong>.</p>
<p>Earlier this year, malicious hackers figured out that many major companies have uploaded massive amounts of valuable and sensitive customer data to Snowflake servers, all the while protecting those Snowflake accounts with little more than a username and password.<span id="more-68041"></span></p>
<p><a href="https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/" target="_blank" rel="noopener">Wired reported</a> last month how the hackers behind the Snowflake data thefts purchased stolen Snowflake credentials from dark web services that sell access to usernames, passwords and authentication tokens that are siphoned by information-stealing malware. For its part, Snowflake says it now requires all new customers to use multi-factor authentication.</p>
<p>Other companies with millions of customer records stolen from Snowflake servers include <strong>Advance Auto Parts</strong>, <strong>Allstate</strong>, <strong>Anheuser-Busch</strong>, <strong>Los Angeles Unified</strong>, <strong>Mitsubishi</strong>, <strong>Neiman Marcus</strong>, <strong>Progressive</strong>, <strong>Pure Storage</strong>, <strong>Santander Bank</strong>, <strong>State Farm</strong>, and <strong>Ticketmaster</strong>.</p>
<p>Earlier this year, AT&amp;T <a href="https://techcrunch.com/2024/03/30/att-reset-account-passcodes-customer-data/" target="_blank" rel="noopener">reset passwords for millions of customers</a> after the company <a href="https://krebsonsecurity.com/2022/08/it-might-be-our-data-but-its-not-our-breach/" target="_blank" rel="noopener">finally acknowledged a data breach from 2018</a> involving approximately 7.6 million current AT&amp;T account holders and roughly 65.4 million former account holders.</p>
<p><strong>Mark Burnett</strong> is an application security architect, consultant and author. Burnett said the only real use for the data stolen in the most recent AT&amp;T breach is to know who is contacting whom and how many times.</p>
<p>&#8220;The most concerning thing to me about this AT&amp;T breach of ALL customer call and text records is that this isn&#8217;t one of their main databases; it is metadata on who is contacting who,&#8221; Burnett <a href="https://infosec.exchange/@zcutlip@hachyderm.io/112774443764622821" target="_blank" rel="noopener">wrote</a> on Mastodon. &#8220;Which makes me wonder what would call logs without timestamps or names have been used for.&#8221;</p>
<p>It remains unclear why so many major corporations persist in the belief that it is somehow acceptable to store so much sensitive customer data with so few security protections. For example, Advance Auto Parts said the data exposed included full names, Social Security numbers, drivers licenses and government issued ID numbers on <a href="https://www.bleepingcomputer.com/news/security/advance-auto-parts-data-breach-impacts-23-million-people/" target="_blank" rel="noopener">2.3 million people</a> who were former employees or job applicants.</p>
<p>That may be because, apart from the class-action lawsuits that invariably ensue after these breaches, there is little holding companies accountable for sloppy security practices. AT&amp;T told the SEC it does not believe this incident is likely to materially impact AT&amp;T&#8217;s financial condition or results of operations. AT&amp;T reported revenues of more than $30 billion in its most recent quarter.</p>


