Wapack Labs Keylogger Blacklist

TLP AMBER ANNOUNCEMENT:

Compromised Email Accounts

Reporting Period: September 24, 2018 

On 24 September 2018, Wapack Labs identified 44 unique email accounts compromised with keyloggers and used to log into mostly personal accounts and organizations. Attackers may be able to access not only email addresses but also financial, social media and other data.

Contact Wapack Labs for more information:
603-606-1246, or feedback@wapacklabs.com 

Action recommendation: Users should immediately place each of these email accounts in a block status in intrusion prevention systems. 

WWW.WAPACKLABS.COM

Wapack Labs Keylogger Blacklist

TLP AMBER ANNOUNCEMENT:

Compromised Email Accounts

Reporting Period: September 19, 2018 

On 19 September 2018, Wapack Labs identified 37 unique email accounts compromised with keyloggers and used to log into mostly personal accounts and organizations. Attackers may be able to access not only email addresses but also financial, social media and other data.

Contact Wapack Labs for more information:
603-606-1246, or feedback@wapacklabs.com 

Action recommendation: Users should immediately place each of these email accounts in a block status in intrusion prevention systems. 

WWW.WAPACKLABS.COM

Wapack Labs Keylogger Blacklist

TLP AMBER ANNOUNCEMENT:

Compromised Email Accounts

Reporting Period: September 12, 2018 

On 12 September 2018, Wapack Labs identified 81 unique email accounts compromised with keyloggers and used to log into mostly personal accounts and organizations. Attackers may be able to access not only email addresses but also financial, social media and other data.

Contact Wapack Labs for more information:
603-606-1246, or feedback@wapacklabs.com 

Action recommendation: Users should immediately place each of these email accounts in a block status in intrusion prevention systems. 

WWW.WAPACKLABS.COM

Wapack Labs Keylogger Blacklist

TLP AMBER ANNOUNCEMENT:

Compromised Email Accounts

Reporting Period: August 27, 2018 

On 27 August 2018, Wapack Labs identified 137 unique email accounts compromised with keyloggers and used to log into mostly personal accounts and organizations. Attackers may be able to access not only email addresses but also financial, social media and other data.

Contact Wapack Labs for more information:
603-606-1246, or feedback@wapacklabs.com 

Action recommendation: Users should immediately place each of these email accounts in a block status in intrusion prevention systems. 

WWW.WAPACKLABS.COM

Nigerian Hacker Leveraging Predator Pain Keylogger

TLP AMBER ANNOUNCEMENT: 

Wapack Labs identified a Nigerian hacker who was responsible for a large 2017 Predator Pain keylogger collection. This actor is actively targeting company sales departments in the Asia-Pacific region with malicious spam e-mails. Once he has established persistence on a target, he monitors internal network activity, records E-mail correspondence, and impersonates company personnel by sending contractors fake invoices...READ MORE 

Wapack Labs has cataloged and reported on Nigerian threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal.    
 

 WWW.WAPACKLABS.COM 

This TLP AMBER report is available only to Red Sky Alliance members.

Aeronautical Phishing Campaign Targets Transportation

TLP AMBER ANNOUNCEMENT:

Several email accounts were identified as part of an apparently unsuccessful phishing attack on several transportation related organizations. These email addresses were targeted in a phishing campaign, but the intended victims did not receive the phishing message due to a rate limit on the attacker’s email account. While the phishing message body was not observed, the subject line of the message was “Court Notice,” indicating the lure to be legal themed. The unsuccessful phishing attack took place on 15 January 2017. Monitoring of the keylogger data is ongoing, however, Wapack Labs has no further information at this time...READ MORE

Wapack Labs has cataloged and reported phishing attacks and credential theft in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Indian Physical Security Company Compromise

TLP AMBER ANNOUNCEMENT: 

On 15 July 2017, Wapack Labs identified, with high confidence, four keylogged email accounts identified as compromised, including username and password, belonging to an Indian physical security company. These email accounts were used to harvest information from multiple internal systems and external portals. Both the sales and customer relationship management systems may have been compromised. Since many of the keylogger infections have spread through automation, there is a potential for compromise within customer, partner, and supply chain relationships...READ MORE

Wapack Labs has cataloged and reported extensively on keyloggers in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Nigerian Passport Fraud

A known Nigerian keylogger and threat actor was observed was observed on 27 February 2017 sending a phishing email with a United States, Citizenship and Immigration Services (USCIS) and U.S. Embassy lure. The phishing email referenced recent immigration executive orders by President Trump. The email attempted to lure the target into sending the threat actor a copy of his passport presumably to be used as part of the threat actor’s fraudulent activities. Fraudulent use of any legitimate passport can result in financial fraud, terrorist activity, and a whole host of other illegal activities.

Wapack Labs has cataloged and extensively reported on keylogger operations in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM

Keylogger Genealogy: The Grandson of Hawkeye

Gear Informer is the successor to the iSpy Keylogger, which was developed as a replacement for the Hawkeye keylogger. This family of keyloggers is one of the most prevalent in Wapack Labs collections. Daily Show threat actors were quick to adopt it to their maritime shipping campaigns and provided Wapack Labs with our first observed sample...READ MORE

Wapack Labs has extensively reported on keyloggers in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

TLP: AMBER

ACTOR: N/A

SERIAL: TIR-002-2017

COUNTRIES: All

INDUSTRIES: All

REPORT DATE: 20170228

Rebranding iSpy Keylogger: Gear Informer

On 21 December 2016 the developer of iSpy Keylogger, the successor to Hawkeye Keylogger, rebranded the malware as Gear Informer. At the same time, the developer changed his persona. Current users of iSpy Keylogger were given until 31 January 2017 to update their clients before it was shut down.

Wapack Labs has reported on iSpy Keylogger in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

TLP: GREEN

ACTOR TYPE: (N/A)

SERIAL: TR-0XX-2017

COUNTRIES: ALL

INDUSTRIES: Financial

REPORT DATE: 20170210

Russian Keylogger Persevers: Intelligence Assessment

On 24 January 2017, Wapack Labs began collecting keylogger data associated with a threat actor's email address. All of the collected data that was associated with the threat actor indicated that the keylogging campaign has not yet become operational. Metadata contained within the keylogger output indicated the threat actor is located in Western Russia. A screenshot of the threat actor, installing a cracked copy of a popular keylogger program, indicates it was obtained from a Russian underground forum. The actor makes white-supremacist references, but it is unknown if the references are indicative of the threat actor’s motivations or intended to mislead/insult malware researchers...READ MORE

Wapack Labs has reported extensively on Russian threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

TLP: AMBER

ACTOR TYPE: (II)

SERIAL: IA-002-2017

COUNTRIES: XZ

INDUSTRIES: N/A

REPORT DATE: 20170210

Early Warning of a Russian Keylogger Campaign

On 24 January 2017, Wapack Labs began collecting keylogger data associated with a threat actor's email address. All of the collected data that was associated with the threat actor indicated that the keylogging campaign has not yet become operational. Metadata contained within the keylogger output indicated the threat actor is located in Western Russia. A screenshot of the threat actor, installing a cracked copy of a popular keylogger program, indicates it was obtained from a Russian underground forum. The actor makes white-supremacist references, but it is unknown if the references are indicative of the threat actor’s motivations or intended to mislead/insult malware researchers. 

Wapack Labs has reported extensively on Russian threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal in the Red Sky Alliance Portal.

TLP: AMBER
ACTOR TYPE: (II)
SERIAL: TR-021-2017
COUNTRIES: XZ
REPORT DATE: 20170127

Olympic Vision aka Codelux

Wapack Labs assesses, with moderate confidence, that Olympic Vision products will continue to be sought after as a one-stop-shop for cyber criminals.  The remote access keylogger known as Olympic Vision (formerly Codelux) makes it an attractive option for budget minded hackers. Olympic Vision possesses a weakness that pertains to the internal licensing requiring the hacker to maintain payment on the keylogger’s subscription license.  Malware authors often use custom crypters like Olympic Crypter to prevent detection by Anti-Virus solutions. Olympic Vision's keyloggers and crypters are available for low rates in one place...READ MORE

Publication Date: 30 December 2016
Handling Requirements: Traffic light protocol (TLP) Green.

Attribution/Threat Actors: Codelux software company 
Actor Type: Adversary capabilities have been assessed as TIER III.

Industries Targeted: Gaming Industry, Financial Sector

Past Reporting: N/A

The full report may be viewed in the Red Sky Alliance as DOC-4572.  

Contact Wapack Labs for more information.

Argentinian Programmer Providing RATs, DDoS & Defacer Keyloggers

Spanish language forum research by Wapack Labs has uncovered an Argentinian programmer who provides numerous malicious tools in many forums.  These tools include numerous forms of Remote Access Tools (RATs), Distributed Denial of Service (DDoS), and defacer keyloggers which can be used in numerous ways - for illegitimate purposes.  This actor appears to be a skilled programmer possibly living in Argentina, as is indicated in the actor's related blog profile.  Its unsure what the motives are since the malicious tools are offered for free.  Actor has been providing malicious tools for the past five years.  This information is being supplied for your situational awareness. 

Publication date:                            20 October 2016

Handling requirements:                  Traffic light protocol (TLP) GREEN

Attribution/Threat Actor:               Argentina

Actor Type:                                    Adversary capabilities have been assessed as Tier II*

Potential Targets:                           Worldwide – Spanish/Hispanic consumers

Past Reporting:                               Red Sky Alliance: DOC-4323

* Practitioners with a greater depth of experience, with the ability to develop their own tools (from publicly known vulnerabilities).

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world. 

Port Authority, NY/NJ

www.wikipedia.com

Wapack Labs is tracking intrusion indicators in multiple US and International Maritime Ports. This report is a summary of activity surrounding the Port Authority of NY and NJ.

Ports around the globe are increasingly victimized by attackers using a multitude of new vectors. One that never fails however, is the use of a keylogger delivered via email. In nearly every case, the email is received from a legitimate shipping company, ship’s captain or master, with broken English and an attachment. The attachment, under normal circumstances should be ship’s logistics information. In others however, it’s a key logger that steals credentials, clipboard contents, and documents.

Publication date:                     19 September 2016

Handling requirements:           Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:       Daily Show

Actor Type:                              Tier I, II

Potential Targets:                     Maritime Port Authority

Past Reporting:                         Red Sky Alliance: DOC-2689

Indicators:                                Redacted Key log outputs may be viewed at api.wapacklabs.com.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Victim Notification: Payment Processing Company in Oman Identified

Between 8/23/16 and 9/16/16 a Visa-owed secure payment processing subsidiary company operating in Oman has been identified 35 times in Wapack Labs keylogger collections program.

Publication date:                     19 September 2016

Handling requirements:           Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:       Daily Show

Actor Type:                              Tier I, II

Potential Targets:                     Payment processing

Past Reporting:                         Red Sky Alliance: DOC-2689

Indicators:                                Redacted Key log outputs may be viewed at api.wapacklabs.com.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.