flashpoint – PossibleThreat Articles

The Not-So-Secret Network Access Broker x999xx

July 3, 2024 0 Comments Breadcrumbs, cobalt strike, cobaltforce, constella intelligence, dashin2008@yahoo.com, flashpoint, intel 471, kirtsov@telecom.ozersk.ru, lockbit, maksim georgievich kirtsov, maksya@icloud.com, maxnmalias-1@yahoo.com, mikhail matveev, Ne'er-Do-Well News, operation endgame, osint.industries, ozersk technological institute national research nuclear university, recorded future, u.s. department of justice, wazawaka, x999xx, Кирцов Максим Георгиевич

Credit to Author: BrianKrebs| Date: Wed, 03 Jul 2024 16:41:34 +0000

Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is “x999xx,” the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.

Independent Krebs Security

A Closer Look at the Snatch Data Ransom Group

September 30, 2023 0 Comments Breadcrumbs, cisa, constella intelligence, databreaches.net, FBI, flashpoint, Ne'er-Do-Well News, perchatka, Ransomware, semen7907, semyon tretyakov, snatch ransomware, snatch team, tretyakov-files@yandex.ru

Credit to Author: BrianKrebs| Date: Sat, 30 Sep 2023 19:47:57 +0000

Earlier this week, KrebsOnSecurity revealed that the darknet website for the Snatch ransomware group was leaking data about its users and the crime gang’s internal operations. Today, we’ll take a closer look at the history of Snatch, its alleged founder, and their claims that everyone has confused them with a different, older ransomware group by the same name.

Independent Krebs Security

Ask Fitis, the Bear: Real Crooks Sign Their Malware

June 1, 2023 0 Comments 165540027, 774748@gmail.com, akafitis@gmail.com, Breadcrumbs, code-signing certificates, constella intelligence, domaintools.com, featar24, fitis, flashpoint, glavmed, intel 471, konstantin evgenievich fetisov, megatraffer, Ne'er-Do-Well News, o.r.z., spamit, spampage@yandex.ru

Credit to Author: BrianKrebs| Date: Thu, 01 Jun 2023 16:15:34 +0000

Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software. This post is a deep dive on “Megatraffer,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015.

Independent Krebs Security

Giving a Face to the Malware Proxy Service ‘Faceless’

April 18, 2023 0 Comments accessapproved, asus666, constella intelligence, denis viktorovich pankov, faceless, flashpoint, gaihnik, lesstroy@mgn.ru, liberty reserve, mrmurza, Ne'er-Do-Well News, omega^gg4u, riley kilmer, shodan, spur.us, u1018928, vadim panov, Web Fraud 2.0

Credit to Author: BrianKrebs| Date: Tue, 18 Apr 2023 20:59:39 +0000

For the past seven years, a malware-based proxy service known as “Faceless” has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised on the service. In this post we’ll examine clues left behind over the past decade by the proprietor of Faceless, including some that may help put a face to the name.

Independent Krebs Security

FBI Seizes Bot Shop ‘Genesis Market’ Amid Arrests Targeting Operators, Suppliers

April 4, 2023 0 Comments A Little Sunshine, FBI, flashpoint, genesis market, genesis security, intel 471, u.s. district court for the eastern district of wisconsin

Credit to Author: BrianKrebs| Date: Tue, 04 Apr 2023 21:04:11 +0000

Several domain names tied to Genesis Market, a bustling cybercrime store that sold access to passwords and other data stolen from millions of computers infected with malicious software, were seized by the Federal Bureau of Investigation (FBI) today. Sources tell KrebsOnsecurity the domain seizures coincided with “dozens” of arrests in the United States and abroad targeting those who allegedly operated the service, as well as suppliers who continuously fed Genesis Market with freshly-stolen data.

Independent Krebs Security

A Retrospective on the 2015 Ashley Madison Breach

July 26, 2022 0 Comments A Little Sunshine, ashley madison breach, avid life media, flashpoint, impact team, intel 471, noel biderman, per thorsheim, robert graham, wired.com

Credit to Author: BrianKrebs| Date: Wed, 27 Jul 2022 01:04:51 +0000

It’s been seven years since the online cheating site AshleyMadison.com was hacked and highly sensitive data about its users posted online. The leak led to the public shaming and extortion of many AshleyMadison users, and to at least two suicides. To date, little is publicly known about the perpetrators or the true motivation for the attack. But a recent review of AshleyMadison mentions across Russian cybercrime forums and far-right underground websites in the months leading up to the hack revealed some previously unreported details that may deserve further scrutiny.

Independent Krebs Security

Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code

April 22, 2022 0 Comments A Little Sunshine, amtrak, Apple, bitbucket, Breadcrumbs, dan goodin, doxbin, electronic arts, emergency data request, everlynn, flashpoint, genesis, globant, iqor, kt, lapsus, lapsus$ jobs, michelin, Microsoft, mobile device management, mox, Ne'er-Do-Well News, NVIDIA, recursion team, russian market, Samsung, sascar, SIM swapping, Slack, source code theft, SWATting, T-Mobile, t-mobile atlas, whitedoxbin

Credit to Author: BrianKrebs| Date: Fri, 22 Apr 2022 13:09:39 +0000

KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of company projects. T-Mobile says no customer or government information was stolen in the intrusion. LAPSUS$ is known for stealing data and then demanding a ransom not to publish or sell it. But the leaked chats indicate this mercenary activity was of little interest to the tyrannical teenage leader of LAPSUS$, whose obsession with stealing and leaking proprietary computer source code from the world’s largest tech companies ultimately led to the group’s undoing.

Independent Krebs Security

Russian Govt. Continues Carding Shop Crackdown

February 9, 2022 0 Comments alexander kovalev, artem bystrykh, denis pachevsky, department k, ferum shop, flashpoint, gemini advisory, get-net llc, infraud, Ne'er-Do-Well News, saratovfilm film company llc, sky-fraud, stas alforov, tass, transtekhkom llc, trump's-dumps, unicc, vladislav gilev, Web Fraud 2.0, yaroslav solovyov

Credit to Author: BrianKrebs| Date: Thu, 10 Feb 2022 01:34:48 +0000

Russian authorities have arrested six men accused of operating some of the most active online bazaars for selling stolen payment card data. The crackdown — the second closure of major card fraud shops by Russian authorities in as many weeks — comes closely behind Russia’s arrest of 14 alleged affiliates of the REvil ransomware gang, and has many in the cybercrime underground asking who might be next.

Independent Krebs Security

Who Wrote the ALPHV/BlackCat Ransomware Strain?

February 2, 2022 0 Comments @cookiedays, A Little Sunshine, alphv ransomware, binrs, blackcat ransomware, blackmatter, Breadcrumbs, catalin cimpanu, darkside, duckerman, duckermanit, flashpoint, jason hill, Ne'er-Do-Well News, paul roberts, ramp, recorded future, reversinglabs, revil, sergey duck, sergey kryakov, sergey penchikov, smiseo, the record, tox, varonis, ybcat

Credit to Author: BrianKrebs| Date: Fri, 28 Jan 2022 13:18:36 +0000

In December 2021, researchers discovered a new ransomware-as-a-service named ALPHV (a.k.a. “BlackCat”), considered to be the first professional cybercrime group to create and use a ransomware strain in the Rust programming language. In this post, we’ll explore some of the clues left behind by the developer who was reputedly hired to code the ransomware variant.

Independent Krebs Security

Who is the Network Access Broker ‘Wazawaka?’

February 2, 2022 0 Comments 902228, abakan, abaza, Breadcrumbs, constella intelligence, cs-arena.org, darkside, ddosis.ru, devdelphi@yandex.ru, domaintools, flashpoint, initial access broker, kopyovo-a, lockbit, mikhail matveev, mikhail mix matveev, mix@devilart.net, mixfb@yandex.ru, Ne'er-Do-Well News, Ransomware, uhodiransomware, wazawaka

Credit to Author: BrianKrebs| Date: Wed, 12 Jan 2022 05:17:31 +0000

In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene.

← Previous