Free Online Payment System Credentials: Contact Señor

Wapack Labs analysts exposed a threat to the financial sector, one who is actively posting in several clear web and underground forums. Within these forums, the actor creates threads of free, downloadable log-in credentials, for an online payment system. Analysts assess that it is likely that the actor is brute-forcing the accounts to obtain the passwords. A brute force attack is a trial and error method used by application programs to decode encrypted data such as passwords - highly effective if the account uses simple passwords. The language, emails, and passwords indicate that the actor is a Spanish or Portuguese speaker, likely operating in South America...READ MORE

Wapack Labs has cataloged and reported extensively on Spanish speaking, threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

ATM Access For Sale in Spanish Underground

An underground seller is marketing ATM maintenance manuals, access keys/codes, and private software for a major ATM manufacturer on an underground Spanish language forum. The seller claims to be an ATM mechanic, working in Mexico. This ATM information could compromise several, major Mexican banks. The ATM manufacturer has a presence in over 130 countries and provides hardware / software for banking and retail systems.

Wapack Labs has cataloged and reported on ATM hacking in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM

Spanish Underground Promotion: Malware Cloaking Tool

Wapack Labs has identified a malware concealing tool that is being promoted by a persona on the Spanish Forum, indectables.net. This report is being provided for your situational awareness.

• Indetectables.net is a very active underground Spanish forum
• The malware cloaking tool is for Windows 7-10
• Undetected malware can have serious ramification to network stability...READ MORE

Publication Date:u30 December 2016

Handling Requirements: Traffic light protocol (TLP) GREEN

Attribution/Threat Actors: Spanish underground forum persona

Actor Type: Adversary capabilities have been assessed as Tier II

Potential Targets: Numerous sectors

Past Reporting: Red Sky Alliance: DOC-4323, 4420, 4469

The full report may be viewed in the Red Sky Alliance as DOC-4573. 

Contact Wapack Labs for more information.

PayPal Balance Reseller en Espanol

A member of a Spanish speaking underground forum is promoting a PayPal balance transfer/payback scheme to clients. This type of financial transaction is illegal and commonly supported by illicit funds. The forum member operates in Latin America, yet promotes business in worldwide Spanish forums. This report is being provided for your situational awareness.

• Spanish forum supports malicious cyber tools and activity.
• Spanish forum member operates in Mexico, Central, and South America
• Spanish forum member accepts payments via Bitcoin, Western Union and OXXO. 

Forum member prefers to communicate via Facebook and accepts payments via Bitcoin, Western Union, and OXXO (a chain of convenience stores from Mexico with over 14,000 stores across Latin America. It also offers money wire transferring services like Western Union). We assess with high confidence that this forum member lives in Latin America, likely Mexico.

Publication Date: 16 December 2016

Handling Requirements: Traffic light protocol (TLP) GREEN

Attribution/Threat Actors: PayPal balance transfer scheme

Actor Type: Adversary capabilities have been assessed as Tier II

Potential Targets: Financial and PayPal

Past Reporting: The full reports may be viewed in Red Sky Alliance as DOC-3969.  Contact Wapack Labs for more information.