Carding Forum Observation

On 15 September 2017, Wapack Labs observed a carding forum advertising services on numerous other carding forums. In addition to selling stolen credit cards (CCs), the forum's database contains thousands of CCs on a global scale. Meta-data and screenshots from several online videos point to the threat actor being from Russia. Wapack Labs will continue to monitor the forum in order to identify the Tactics, Techniques, and Procedures (TTPs) and the persona operating the carding forum.

Wapack Labs has cataloged and reported extensively on Russia and carding forums in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Stolen Credit Cards for Sale Via CryptoCheck Payments

A member of a clear web hacker forum is hosting an active website advertising services.  The website provides links to stolen credit/debit card databases from banks around the world.  This individual is linked to an infamous Ukrainian hacker (indicating actor's popularity) who has long specialized in the sale of stolen credit card information.  Services within this website can be purchased via Bitcoin (BTC), Western Union, Money Gram, and by a service called CyptoCheck.  CryptoCheck is a Russian payment service, which is being researched further.

Wapack Labs has cataloged and reported extensively on carding forums in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM