2018 Cyber Security Threat and Vulnerability Predictions

This report encapsulates our predictions regarding the most significant cyber threats and vulnerabilities for 2018.

• Phishing: Will likely become more popular among novice and criminal hackers.
• Account Targeting: Account credentials are increasingly more available.
• Democratization of Cyber Weapons: 2017 saw the most high-profile ransomware attack to-date with the Wannacry worm.
• Tor Network: 2018 is the year of fighting and winning against the abuse of the Tor network.
• Macro Malware: The popularity of malicious macros for malware delivery continued strong in 2017.
• Geopolitical Tensions: Iran and North Korea tensions continue.
• Blockchain-related Cybercrime: With the establishment of Bitcoin futures and general interest to blockchain technologies, exploitation in this field grows too...READ MORE

Wapack Labs has cataloged and reported on cyber threats and vulnerabilities in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

New Underground Market

Wapack Labs recently observed a new underground market that trades a variety of illegal goods including credit cards, fullz, exploits, botnet builders/installs, and other cyber crime related goods. The forum’s structure and listings resemble another well-known market and may be owned by the same individuals. One seller in the market is selling GozNym 2.0 botnet installs. This seller is selling this botnet on other Tor-based black markets and is operating under same alias. The fraud sections of the market are extremely active. Despite being heavily dominated by drugs and other illegal non-cyber sales, these cyber fraud-based sellers appear highly rated. Wapack Labs has discovered that most high-rated sellers primarily deal with stolen discount gift cards obtained through carding, or with stolen electronic goods, such as like-new Apple and Samsung products. Additionally, this level of fraud sellers are often observed making bulk sales of bank accounts and credit cards...READ MORE

Wapack Labs has cataloged and reported on underground Tor markets in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Anonymous Sub-Group

A small sub-group of the Anonymous collective has recently initiated underground offerings of hackers-for-hire. The group is known for their past experiences in website defacement and for their participation in #opISIS, #OpIceISIS, #OpKillingBay, and #OpFunKill, which are all official Anonymous operations. The group has a forum based on Tor, which is believed to be for clients to interact with the team, however, no clients have yet posted. Wapack Labs believes the leader and founder of the group has advanced hacking skills. His Instagram and Twitter accounts provide several videos exposing DDoS attacks against websites. The group's leader also has used numerous aliases, which are provided in the report. He was once a member of several other groups, including, Powerful Greek Army (P.G.A), Phantom Squad, and Zero0d3. Wapack Labs will continue to monitor the group, their leader, and their hacker- for-hire Tor based service...READ MORE

Wapack Labs has cataloged and reported on Tor based groups and threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal. 

WWW.WAPACKLABS.COM

Tor Network Shrinking

On 5 October 2017, Wapack Analysts observed several prominent Tor-based hacker forums go permanently offline - at the same time. Despite the clearweb address being offline, one of the forum's Tor onion sites was still online, suggesting a potential infiltration of the server; as seen with past law enforcement activities. The forums went offline with out any announcement or reason given for the disappearance. Several Reddit users have re-circulated the onion sites and are now speculating about what happened. In a recent blog post by Gizmodo, they explain that the Tor network is statistically shrinking. Gizmodo, utilizing the Onionscan tool, scanned a list of over 30,000 onion domains and reported only 4,400 online. Wapack Analysts have not observed any new Tor-based hacking forums for more than a week, suggesting possibly, a move away from Tor and on to different channels of communication...READ MORE

Wapack Labs has cataloged and reported Tor network activity and trends in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

New Tor Forum Recruiting Members

On 21 September 2017, Wapack labs observed a new tor based forum. The discovery was made while monitoring another space where members post and review dark web markets. The forum is recently new and has three main discussion sections within the forum: Drugs, Fraud, and General. With the forum recently opening for registration, the number of members is likely to grow. If members from other forums have migrated to the new forum, it has potential to become a reliable replacement market on the dark web. Wapack Labs will monitor the new forum and report on any activities affecting Red Sky Alliance members...READ MORE 

Wapack Labs has cataloged and reported extensively on Tor forums and markets in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

TOR "Skimmer Shop"

On 20 September 2017, Wapack Labs observed a Tor site selling a variety of credit card skimming devices. The owners of the Tor site claim to produce and modify all the products in their own workshops, which are purported to be located in the U.S. and Europe. The website states the business began in early 2015 and now consists of eleven (11) technically trained employees. The skimmer shop sells a variety of skimmers based on the shopper’s interests. The website presents various skimmer sections: ATM, gas pump, GSM (Global System for Mobile communication) receivers, POS, RFID, readers, and other skimmer accessories. Prices range from $800.00 USD to $1800.00 USD, depending on the skimmer wanted. Wapack Labs will continue to monitor this dark net skimmer shop in attempt to identify and monitor the threat actors and their activities...READ MORE

Wapack Labs has cataloged and reported extensively on Tor network shops in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Rogue Money Shredders

On 15 September 2017, Wapack Labs observed a new Tor onion involving rogue, foreign money shredders. They claim to be apart of a large network of shredders who devalue Swiss Franc currency by re-circulating, or converting, the Francs into other currencies: U.S. Dollars (USD), Euro (EUR), and the British Pound (GBP). The hard currency that is to be shredded must be deteriorated, have holes, or is a beyond a specific date - laundering only small amounts at a time. In order to procure the cash, they claim to use anonymous bitcoin bribes and violent threats. They state that the currency used is legitimate and legal; warning counterfeit currency is illegal. The legitimacy of their hard currency product(s) is unknown. Wapack Labs will continue to research the groups' capabilities and attempt to identify the actors involved in this currency operation...READ MORE

Wapack Labs has cataloged and reported extensively on Tor forums and money laundering in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Life After AlphaBay: TradeRoute

TLP AMBER ANNOUNCEMENT: 

On 04 August 2017, Wapack Labs discovered TradeRoute, a Russian and English Tor-based marketplace and forum on the dark net that focuses on the sale of illegal drugs. However, vendors also sell electronics, digital goods, forgeries, hacking services, lab equipment for narcotics, fashion counterfeits, and fraud services. With the recent takedowns by law enforcement of Hansa Market and AlphaBay (past reporting by Wapack Labs), actors are migrating to TradeRoute quickly making it a leading dark net marketplace...READ MORE

Wapack Labs has cataloged and reported extensively on Tor marketplaces and forums in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Shadowbrokers and the Scylla Hacking Store

The ShadowBrokers (SB) have recently started a new Tor based market called Scylla Hacking Store. SB is selling several APT stolen exploits (US, Russian and Chinese exploits), crimewave exploit kits, and other crimewave hacking tools: bots, hash cracking, and Microsoft Office exploits. Analysts believe, with medium confidence, the recent Petya activity may be related to SB sales of all the payload source code for the FuzzBunch framework, which included, EternalBlue...READ MORE

Wapack Labs has cataloged and reported extensively on the ShadowBrokers in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Petya/NotPetya and Really Not Petya - Loki Bot Credential Stealing Malware

In late June 2017, Wapack Labs identified a malicious email targeting Ukrainian Financial Institutions (FI) to deliver a credential stealing malware called Loki Bot. This incident happened at the same time as the Petya/NotPetya Ransomware outbreak, which also targeted Ukrainian banking infrastructure. Possibly due to the confusion generated during the initial Petya/NotPetya outbreak, Loki Bot samples and C2s were reported as being Petya/NotPetya ransomware. Further confusion resulted when Anti-virus (AV) detections began identifying Loki Bot as Petya/NotPetya. Loki Bot is sold in underground Tor marketplaces and can steal passwords from browsers, File Transfer Protocol (FTP) applications, email accounts, and crypto-coin wallets. This report discusses the misattribution of Loki Bot, along with technical details of analyzed Loki Bot samples…

Get the full report here. 

Wapack Labs has cataloged and reported extensively on Loki Bot, and Loki RAT, in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Darknet Marketplace Exposes Financial Items on Global Scale

Wapack Labs Analysts are researching a Tor-based darknet marketplace that sells stolen financial items; credit cards, gift cards, and occasionally provides free dumps that exposed Personally Identifiable Information (PII) of individuals. New accounts are available every week and the marketplace's administrators claim they are 100% verified - how-to manuals are provided with transactions. The marketplace is operating on a global basis, their stolen products are from the US, EU, Oceania, and Russia. Further research is being conducted to identity the source of the stolen credit cards...READ MORE

Wapack Labs has cataloged and reported extensively on darknet marketplaces in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Tor-base Site Operates Illegal Sales Under AES 256-bit Encryption

Wapack Labs discovered a Tor-based website conducting illegal financial sector activities; ranging from carding and counterfeit money to electronics and narcotics. The site, which requires no registration, claims that the forum is totally anonymous and highly secure; largely in part to encrypting all data with AES 256-bit encryption. The site provides a multi-signature escrow for all transactions; allowing safe Bitcoin (BTC) transactions between both parties...READ MORE

Wapack Labs has cataloged and reported extensively on Tor-based and carding activities in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Steal from the Rich, to Give to the Poor: A Cyber Brotherhood's Tale

Wapack Labs is researching a self-proclaimed cyber brotherhood that has pledged to halt the unjust distribution of money. For the past year, this brotherhood has been hosting a dark web domain where they provide stolen financial information. They offer stolen PayPal accounts, money-back guarantee, and a discount if more than one account is purchased. Before being granted access, prospective users are required to submit an application via TorBox email.

Wapack Labs has cataloged and reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

The Taxman Cometh: Selling W-2 Forms in the Darkweb

Wapack Labs has identified an actor in the Tor-based markets - we have labeled “Taxman”. Taxman is selling U.S. W-2 Forms from 2016 as well as taxpayer dates of birth. He also sells bank account information for at least one U.S. and one Australian bank, as well as Credit Reports. Taxman also sells botnets, along with installation and support for same. He is a verified vendor on several Darkweb Tor-based .onion domains and deals exclusively in Bitcoin. 

TLP: AMBER
ACTOR TYPE: (III)
SERIAL: TR-030-2017
COUNTRIES: US, Australia
INDUSTRIES: Financial
REPORT DATE: 20170207

AlphBay: DDoS-for-hire Service Author

AlphaBay Market is a well-known TOR based underground website that advertises, for sale, many malicious cyber tools and services. A known DDoS-for-hire service author has been operating in AlphaBay. Author claims to have successfully targeted multiple corporations. This information is being provided for your situational awareness.

• AlphaBay is hosted in The Onion Router (TOR) network.

• The AlphaBay Market is notorious for selling malicious cyber tools and services.

• DDoS-for-hire service author is a threat actor who provides malicious DDoS services.

Publication Date: 3 December 2016
Handling Requirements: Traffic light protocol (TLP) GREEN
Attribution/Threat Actor: DDoS-for-hire service author
Actor Type: Adversary capabilities have been assessed as Tier IV
Potential Targets: All; Distributed Denial of Service (DDoS) for hire provider
Past Reporting: DOC-4214