• Search for:
    28 Jan, 2022
    Who Wrote the ALPHV/BlackCat Ransomware Strain?
    Cybersecurity , , , , , , , , , , , , , , , , , , , , , , , , , ,

    In December 2021, researchers discovered a new ransomware-as-a-service named ALPHV (a.k.a. “BlackCat”), considered to be the first professional cybercrime group to create and use a ransomware strain in the Rust programming language. In this post, we’ll explore some of the clues left behind by the developer who was reputedly hired to code the ransomware variant. …

    Read MoreWho Wrote the ALPHV/BlackCat Ransomware Strain?

    12 Jan, 2022
    Who is the Network Access Broker ‘Wazawaka?’
    Cybersecurity , , , , , , , , , , , , , , , , , , , , ,

    In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene. …

    Read MoreWho is the Network Access Broker ‘Wazawaka?’

    3 Dec, 2021
    Who Is the Network Access Broker ‘Babam’?
    Cybersecurity , , , , , , , , , ,

    Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in stealing remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. In this post we’ll look at the clues left behind by “Babam,” the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years. …

    Read MoreWho Is the Network Access Broker ‘Babam’?

    9 Nov, 2021
    REvil Ransom Arrest, $6M Seizure, and $10M Reward
    Cybersecurity , , , , , , , ,

    The U.S. Department of Justice said today it arrested a Ukrainian man who deployed ransomware on behalf of the REvil ransomware gang, a Russian cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency sent to another REvil affiliate, and that the State Department is now offering up to $10 million for information leading to the arrest of any key leaders of REvil. …

    Read MoreREvil Ransom Arrest, $6M Seizure, and $10M Reward

    15 Jun, 2021
    How Does One Get Hired by a Top Cybercrime Gang?
    Cybersecurity , , , , , , ,

    The U.S. Department of Justice (DOJ) last week announced the arrest of a 55-year-old Latvian woman who’s alleged to have worked as a programmer for Trickbot, a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware. Just how did a self-employed web site designer and mother of two come to work for one of the world’s most rapacious cybercriminal groups and then leave such an obvious trail of clues indicating her involvement with the gang? This post explores answers to those questions, as well as some of the ways Trickbot and other organized cybercrime gangs gradually recruit, groom and trust new programmers. …

    Read MoreHow Does One Get Hired by a Top Cybercrime Gang?

    29 May, 2021
    Using Fake Reviews to Find Dangerous Extensions
    Cybersecurity , , , , , , , , , , , , , , ,

    Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here’s the story of how bogus reviews on a counterfeit Microsoft Authenticator browser extension exposed dozens of other extensions that siphoned personal and financial data. …

    Read MoreUsing Fake Reviews to Find Dangerous Extensions

    15 Mar, 2021
    WeLeakInfo Leaked Customer Payment Info
    Cybersecurity , , , , , , , , ,

    A little over a year ago, the FBI and law enforcement partners overseas seized WeLeakInfo[.]com, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data for 23,000 people who paid to access the service with a credit card. …

    Read MoreWeLeakInfo Leaked Customer Payment Info

    20 Apr, 2020
    Who’s Behind the “Reopen” Domain Surge?
    Cybersecurity , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

    The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control measures and state leaders who’ve enacted strict social distancing restrictions in the face of the COVID-19 pandemic. Here’s a closer look at who and what appear to be behind these domains. …

    Read MoreWho’s Behind the “Reopen” Domain Surge?

    23 Mar, 2020
    Who’s Behind the ‘Web Listings’ Mail Scam?
    Cybersecurity , , , , , , , , , , , , , , , , , , , , , , , , , ,

    In December 2018, KrebsOnSecurity looked at how dozens of U.S. political campaigns, cities and towns had paid a shady company called Web Listings Inc. after receiving what looked like a bill for search engine optimization (SEO) services rendered on behalf of their domain names. The story concluded that this dubious service had been scamming people and companies for more than a decade, and promised a Part II to explore who was behind Web Listings. What follows are some clues that point to a very convincing answer to that question. …

    Read MoreWho’s Behind the ‘Web Listings’ Mail Scam?

    10 Mar, 2020
    FBI Arrests Alleged Owner of Deer.io, a Top Broker of Stolen Accounts
    Cybersecurity , , , , , , , ,

    FBI officials last week arrested a Russian computer security researcher on suspicion of operating deer.io, a vast marketplace for buying and selling stolen account credentials for thousands of popular online services and stores. Kirill V. Firsov was arrested Mar. 7 after arriving at New York’s John F. Kennedy Airport, according to court documents unsealed Monday. Prosecutors with the U.S. District Court for the Southern District of California allege Firsov was the administrator of deer.io, an online platform that hosted more than 24,000 shops for selling stolen and/or hacked usernames and passwords for a variety of top online destinations. …

    Read MoreFBI Arrests Alleged Owner of Deer.io, a Top Broker of Stolen Accounts