New Kids on the Block

Wapack Labs is researching a new card vendor in the underground going by the name “18th Street Gang Shop” (18SGS). The actual 18th Street Gang is one of the largest youth gangs in the western hemisphere, and has close ties to the Mexican Mafia. It is unclear if the actual street gang is operating this site or if someone is co-opting their name. Users may visit the 18SGS shop, create a free account, and access their stolen credit card database. Wapack Labs filtered records and discovered thousands of credit cards belonging to numerous U.S. banks and one major home improvement store.

Wapack Labs has cataloged and reported extensively on hackers and carders in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

APT's Code Used Against Global Government Financial Websites

The code, tactics, techniques, and procedures (TTP) used against government financial regulatory websites in Poland, Mexico, and Uruguay are all too similar to be coincidental. These attacks are almost certainly being carried out by a known APT Group. Security researchers in Poland are uncovering artifacts from a recent breach where attackers used that country’s financial regulatory organization’s website to spread malware. Indicators of Compromise (IOCs) that led to the discovery included abnormal network traffic and unknown encrypted executables resident on victim machines. This APT Group has targeted Asian based financial institutions and manufacturing companies since at least 2009; in addition to stealing $81M from global financial institutions. They were also attributed with cyber espionage campaigns. Technical details of the attack in Poland, and mitigations are provided herein...READ MORE

Wapack Labs has cataloged and reported extensively on APT malware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.


WWW.WAPACKLABS.COM

ATM Access For Sale in Spanish Underground

An underground seller is marketing ATM maintenance manuals, access keys/codes, and private software for a major ATM manufacturer on an underground Spanish language forum. The seller claims to be an ATM mechanic, working in Mexico. This ATM information could compromise several, major Mexican banks. The ATM manufacturer has a presence in over 130 countries and provides hardware / software for banking and retail systems.

Wapack Labs has cataloged and reported on ATM hacking in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM

Selling PayPal Accounts: Spanish Language Facebook Group

On 31 January 2017, Wapack Labs discovered a private Spanish language group on Facebook. This group sells compromised Mexican and German PayPal accounts for amounts between $500 and $1,000 Mexican Pesos. Wapack Labs believes, with medium to high confidence, that the administrators of the group are from Mexico; as they conduct transactions in Mexican Pesos. It is unclear at this time how they gain control of the accounts they are selling. Once a buyer pays for an account, the group provides expanded details on the account. 

Wapack Labs extensively reported on PayPal fraud schemes in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

The following organizations were cited in this report: PayPal, Facebook

TLP: AMBER
ACTOR TYPE: (N/A)
SERIAL: TR-024-2017
COUNTRIES: US (FL) & MX, DE
INDUSTRIES: Financial
REPORT DATE: 20170202

PayPal Balance Reseller en Espanol

A member of a Spanish speaking underground forum is promoting a PayPal balance transfer/payback scheme to clients. This type of financial transaction is illegal and commonly supported by illicit funds. The forum member operates in Latin America, yet promotes business in worldwide Spanish forums. This report is being provided for your situational awareness.

• Spanish forum supports malicious cyber tools and activity.
• Spanish forum member operates in Mexico, Central, and South America
• Spanish forum member accepts payments via Bitcoin, Western Union and OXXO. 

Forum member prefers to communicate via Facebook and accepts payments via Bitcoin, Western Union, and OXXO (a chain of convenience stores from Mexico with over 14,000 stores across Latin America. It also offers money wire transferring services like Western Union). We assess with high confidence that this forum member lives in Latin America, likely Mexico.

Publication Date: 16 December 2016

Handling Requirements: Traffic light protocol (TLP) GREEN

Attribution/Threat Actors: PayPal balance transfer scheme

Actor Type: Adversary capabilities have been assessed as Tier II

Potential Targets: Financial and PayPal

Past Reporting: The full reports may be viewed in Red Sky Alliance as DOC-3969.  Contact Wapack Labs for more information.