Darknet Private Market Selling Hacked Accounts

Wapack Labs is researching an active, darknet actor in a private market. The private market is a multisignature, escrow shopping system based in Europe. The darknet actor is currently advertising breached accounts on their site to include: Paypal, Amazon, Ebay, and Venmo, and has a 97.3% positive feedback rating. Banking information from several U.S. banks having accounts with balances of $10,000+ and $20,000+ are offered. The actor is also selling hacked social media accounts like Instagram and Snapchat. Hacked social media accounts are dangerous as they can be used to hide nefarious activity ranging from pranking to obtaining passwords to compromise banks and online retailers.

Wapack Labs has cataloged and reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

The Amateur from Algeria

On March, 1, 2017 Wapack Labs Researcher observed a hacker providing malicious tools on various Arabic, Russian, and English hack-forums. He was observed selling gift cards for Bitcoin (BTC), promoting phishing scams, and posting website defacements. The hacker has the necessary skills to create basic exploits. The fact that his malicious software is free, may speak to its quality - or people’s trust in a novice...READ MORE

Wapack Labs has extensively reported on carders in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

TLP: AMBER

ACTOR TYPE: (II)

SERIAL: TR-042-2017

COUNTRIES: DZ

INDUSTRIES: Financial

REPORT DATE: 20170301

Black Hat Hackers Target Healthcare

A known black hat hacker collective is currently ransoming 500GB of internal documents, including intellectual property belonging to one of the 50 Top Sellers on Amazon, via a Remote Desktop Protocol (RDP). This group is infamous for hacking healthcare systems in the U.S. and other corporate institutions - then selling the data. This information is being supplied for your situational awareness.

• Recent, successful black hat hackers.

• Active in hacking institutions, focusing on the U.S. healthcare industry.

• Company belonging to the 50 Top Sellers on Amazon has been the most recent victim.

Publication date:  19 November 2016

Handling requirements:  Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:  Black Hat Hacker Collective

Actor Type:  Adversary capabilities have been assessed as Tier III*

Potential Targets:  U.S. Healthcare industry, other industries

Past Reporting:  DOC-4055, DOC-4203