Darknet Private Market Selling Hacked Accounts

Wapack Labs is researching an active, darknet actor in a private market. The private market is a multisignature, escrow shopping system based in Europe. The darknet actor is currently advertising breached accounts on their site to include: Paypal, Amazon, Ebay, and Venmo, and has a 97.3% positive feedback rating. Banking information from several U.S. banks having accounts with balances of $10,000+ and $20,000+ are offered. The actor is also selling hacked social media accounts like Instagram and Snapchat. Hacked social media accounts are dangerous as they can be used to hide nefarious activity ranging from pranking to obtaining passwords to compromise banks and online retailers.

Wapack Labs has cataloged and reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

The Amateur from Algeria

On March, 1, 2017 Wapack Labs Researcher observed a hacker providing malicious tools on various Arabic, Russian, and English hack-forums. He was observed selling gift cards for Bitcoin (BTC), promoting phishing scams, and posting website defacements. The hacker has the necessary skills to create basic exploits. The fact that his malicious software is free, may speak to its quality - or people’s trust in a novice...READ MORE

Wapack Labs has extensively reported on carders in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

TLP: AMBER

ACTOR TYPE: (II)

SERIAL: TR-042-2017

COUNTRIES: DZ

INDUSTRIES: Financial

REPORT DATE: 20170301

Selling PayPal Accounts: Spanish Language Facebook Group

On 31 January 2017, Wapack Labs discovered a private Spanish language group on Facebook. This group sells compromised Mexican and German PayPal accounts for amounts between $500 and $1,000 Mexican Pesos. Wapack Labs believes, with medium to high confidence, that the administrators of the group are from Mexico; as they conduct transactions in Mexican Pesos. It is unclear at this time how they gain control of the accounts they are selling. Once a buyer pays for an account, the group provides expanded details on the account. 

Wapack Labs extensively reported on PayPal fraud schemes in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

The following organizations were cited in this report: PayPal, Facebook

TLP: AMBER
ACTOR TYPE: (N/A)
SERIAL: TR-024-2017
COUNTRIES: US (FL) & MX, DE
INDUSTRIES: Financial
REPORT DATE: 20170202

PayPal Balance Reseller en Espanol

A member of a Spanish speaking underground forum is promoting a PayPal balance transfer/payback scheme to clients. This type of financial transaction is illegal and commonly supported by illicit funds. The forum member operates in Latin America, yet promotes business in worldwide Spanish forums. This report is being provided for your situational awareness.

• Spanish forum supports malicious cyber tools and activity.
• Spanish forum member operates in Mexico, Central, and South America
• Spanish forum member accepts payments via Bitcoin, Western Union and OXXO. 

Forum member prefers to communicate via Facebook and accepts payments via Bitcoin, Western Union, and OXXO (a chain of convenience stores from Mexico with over 14,000 stores across Latin America. It also offers money wire transferring services like Western Union). We assess with high confidence that this forum member lives in Latin America, likely Mexico.

Publication Date: 16 December 2016

Handling Requirements: Traffic light protocol (TLP) GREEN

Attribution/Threat Actors: PayPal balance transfer scheme

Actor Type: Adversary capabilities have been assessed as Tier II

Potential Targets: Financial and PayPal

Past Reporting: The full reports may be viewed in Red Sky Alliance as DOC-3969.  Contact Wapack Labs for more information.