Black Hat Hackers: Counterfeit Coupons

Wapack Labs research into the hacker underground has uncovered a group of black hat hackers who claim to have taken over a coupon counterfeiting business. This black hat collective may have an affiliation with another threat actor who operated in the dark web marketplace, SilkRoad, and was sentenced to prison for selling counterfeit coupons. This information is being provided for your situational awareness. 

• Collective is a self-described all female, black hat hacking group.
• Collective appears to have taken over coupon counterfeiting cyber business.
• Collective offers a variety of counterfeit coupons to be exploited at self-checkout lanes in retail stores.

Publication Date: 7 December 2016

Handling Requirements: Traffic light protocol (TLP) GREEN

Attribution/Threat Actors: Black Hat Hacking Collective

Actor Type: Adversary capabilities have been assessed as Tier II

Potential Targets: Financial, business and retail sectors

Past Reporting: Msg/#8168 & 8722

Black Hat Hackers Target Healthcare

A known black hat hacker collective is currently ransoming 500GB of internal documents, including intellectual property belonging to one of the 50 Top Sellers on Amazon, via a Remote Desktop Protocol (RDP). This group is infamous for hacking healthcare systems in the U.S. and other corporate institutions - then selling the data. This information is being supplied for your situational awareness.

• Recent, successful black hat hackers.

• Active in hacking institutions, focusing on the U.S. healthcare industry.

• Company belonging to the 50 Top Sellers on Amazon has been the most recent victim.

Publication date:  19 November 2016

Handling requirements:  Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:  Black Hat Hacker Collective

Actor Type:  Adversary capabilities have been assessed as Tier III*

Potential Targets:  U.S. Healthcare industry, other industries

Past Reporting:  DOC-4055, DOC-4203

Active Black Hat Hacker Advertising Tools

www.google.com

On 25 August 2016, Wapack Labs identified an active black hat hacker of possible importance.  Identified were sites including a database lookup tool and a DDoS tool.  We are providing this information for your situational awareness.

Publication date:                            25 August 2016

Handling requirements:                  Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:              Arggon hacker identification

Actor Type:                                     Tier II or III           

Potential Targets:                           USA / International

Past Reporting:                               DOC-3961, DOC-2163, DOC-2657

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Social Media and Hacker Communication

On 23 August 2016, Wapack Labs identified a Twitter post that exposed the black hat Hacker, Revolver, who claims to possess the current, alleged, NSA/Equation Group downloaded files.  The hacker initially posted them for sale and subsequently posted the downloaded files for free.  We are providing this information for your situational awareness.

Publication date:                            23 August 2016

Handling requirements:                  Traffic light protocol (TLP) AMBER

Attribution/Threat Actors:              OSINT –  Hacker information

Actor Type:                                     Tier II     

Potential Targets:                           USA / International

Past Reporting:                               Red Sky Alliance: DOC-4133

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.