The Darknet's Brickr Ransomware

Wapack Labs analysts observed an actor, on the darknet, advertising Brickr v1 Ransomware. Brickr v1’s purpose is “to be affordable, cheap and reliable product.” Buyers must contact the actor through Jabber or through the darknet forum's private messenger. Brickr v1 encrypts a user's personal files, if executed. To receive the decryption key, a ransom must be paid. As of 28 May 2017, Brickr v1 was for sale at $80.00 via Bitcoin (BTC). An article was published on how to remove Brickr Ransomware using task manager, which prompted the actor to include a new feature that will temporarily disable the task manager when executed. The actor revealed that Brickr v2 is under development and will include upgraded features. Wapack Labs will continue to monitor the forum, track all versions of this malware, and attempt to identify the actor.

Wapack Labs has cataloged and reported extensively on ransomware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Shopping Spree with Stolen Credit Cards

While researching a clear web hacker/carder forum, Wapack Labs analysts found a unique domain. Users register for a 15-minute “shopping spree” and are issued a password to their database. The domain has many international cards and boasts over 1 million cards from the U.S.. Once users choose their stolen cards, they add them to a shopping cart, just like a legitimate e-commerce site. The domain filters their database by BIN, Brand, Type, Level, Bank, Country, State, City, ZIP Code, Address, Seller, Base, Load, Expiration Date, Valid, or Sort. All purchases are made via BitCoin.

Wapack Labs has cataloged and reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Russian Hacker: DDoS Services for Hire

Wapack Labs is researching an established Russian hacker who provides DDoS services for hire. The hacker offers a wide variety of DDoS attacks which can be accomplished on any specified port - guarantees 100% anonymity and a 100% refund for a failed DDoS attack. The cost for services vary. Payments may be made in Webmoney, Qiwi, and Bitcoin. All communication is over ICQ, Jabber, or Telegram.

Wapack Labs has cataloged and reported extensively on DDoS hackers in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Ransomware Developer Seeks Long-lasting Partners

Wapack Labs is analyzing a ransomware developer who is advertising on several high profile hacker forums. The developer is in-search of highly skilled and reliable partners to work on common interests; offering a synopsis of the program. The developers current ransomware runs on Windows OS x86/x64 platforms. The malware's decrypter is only available for an infected system when 100% of the payment has been made. The developer states it will generate a unique Bitcoin (BTC) address for ransom payment, for each individual infection.

Wapack Labs has cataloged and reported extensively on ransomware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

The Carder Wears Prada: Reselling Stolen Credit Cards

Wapack Labs is researching an international carder who is advertising the sale of thousands of stolen, credit/debit cards worldwide. This carder advertises on several clearweb and deepweb forums, asserting a validity rate of 80-100%, and confirms invalid cards will be refunded. A buyer can create an account to permit shopping inside their database which, contains the stolen credit/debit cards. Full encryption is provided with each card dump, which includes all pertinent banking credentials. This carder utilizes bitcoin (BTC) for payment transactions.

Wapack Labs has reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM

Stolen Credit Cards for Sale Via CryptoCheck Payments

A member of a clear web hacker forum is hosting an active website advertising services.  The website provides links to stolen credit/debit card databases from banks around the world.  This individual is linked to an infamous Ukrainian hacker (indicating actor's popularity) who has long specialized in the sale of stolen credit card information.  Services within this website can be purchased via Bitcoin (BTC), Western Union, Money Gram, and by a service called CyptoCheck.  CryptoCheck is a Russian payment service, which is being researched further.

Wapack Labs has cataloged and reported extensively on carding forums in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM