• Search for:
    10 Feb, 2022
    Russian Govt. Continues Carding Shop Crackdown
    Cybersecurity , , , , , , , , , , , , , , , , , , ,

    Russian authorities have arrested six men accused of operating some of the most active online bazaars for selling stolen payment card data. The crackdown — the second closure of major card fraud shops by Russian authorities in as many weeks — comes closely behind Russia’s arrest of 14 alleged affiliates of the REvil ransomware gang, and has many in the cybercrime underground asking who might be next. …

    Read MoreRussian Govt. Continues Carding Shop Crackdown

    28 Jan, 2022
    Who Wrote the ALPHV/BlackCat Ransomware Strain?
    Cybersecurity , , , , , , , , , , , , , , , , , , , , , , , , , ,

    In December 2021, researchers discovered a new ransomware-as-a-service named ALPHV (a.k.a. “BlackCat”), considered to be the first professional cybercrime group to create and use a ransomware strain in the Rust programming language. In this post, we’ll explore some of the clues left behind by the developer who was reputedly hired to code the ransomware variant. …

    Read MoreWho Wrote the ALPHV/BlackCat Ransomware Strain?

    12 Jan, 2022
    Who is the Network Access Broker ‘Wazawaka?’
    Cybersecurity , , , , , , , , , , , , , , , , , , , , ,

    In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene. …

    Read MoreWho is the Network Access Broker ‘Wazawaka?’

    3 Dec, 2021
    Who Is the Network Access Broker ‘Babam’?
    Cybersecurity , , , , , , , , , ,

    Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in stealing remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. In this post we’ll look at the clues left behind by “Babam,” the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years. …

    Read MoreWho Is the Network Access Broker ‘Babam’?

    2 Nov, 2021
    The ‘Groove’ Ransomware Gang Was a Hoax
    Cybersecurity , , , , , , , , , , , , ,

    A number of publications in September warned about the emergence of “Groove,” a new ransomware group that called on competing extortion gangs to unite in attacking U.S. government interests online. It now appears that Groove was all a big hoax designed to toy with security firms and journalists. …

    Read MoreThe ‘Groove’ Ransomware Gang Was a Hoax

    11 May, 2021
    A Closer Look at the DarkSide Ransomware Gang
    Cybersecurity , , , , , ,

    The FBI confirmed this week that a relatively new ransomware group known as DarkSide is responsible for an attack that caused Colonial Pipeline to shut down 5,550 miles of pipe, stranding countless barrels of gasoline, diesel and jet fuel on the Gulf Coast. Here’s a closer look at the DarkSide cybercrime gang, as seen through their negotiations with a recent U.S. victim that earns $15 billion in annual revenue. …

    Read MoreA Closer Look at the DarkSide Ransomware Gang

    15 Mar, 2021
    WeLeakInfo Leaked Customer Payment Info
    Cybersecurity , , , , , , , , ,

    A little over a year ago, the FBI and law enforcement partners overseas seized WeLeakInfo[.]com, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data for 23,000 people who paid to access the service with a credit card. …

    Read MoreWeLeakInfo Leaked Customer Payment Info