Free Online Payment System Credentials: Contact Señor

Wapack Labs analysts exposed a threat to the financial sector, one who is actively posting in several clear web and underground forums. Within these forums, the actor creates threads of free, downloadable log-in credentials, for an online payment system. Analysts assess that it is likely that the actor is brute-forcing the accounts to obtain the passwords. A brute force attack is a trial and error method used by application programs to decode encrypted data such as passwords - highly effective if the account uses simple passwords. The language, emails, and passwords indicate that the actor is a Spanish or Portuguese speaker, likely operating in South America...READ MORE

Wapack Labs has cataloged and reported extensively on Spanish speaking, threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

The Carder Wears Prada: Reselling Stolen Credit Cards

Wapack Labs is researching an international carder who is advertising the sale of thousands of stolen, credit/debit cards worldwide. This carder advertises on several clearweb and deepweb forums, asserting a validity rate of 80-100%, and confirms invalid cards will be refunded. A buyer can create an account to permit shopping inside their database which, contains the stolen credit/debit cards. Full encryption is provided with each card dump, which includes all pertinent banking credentials. This carder utilizes bitcoin (BTC) for payment transactions.

Wapack Labs has reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM

Dangerous Platform: Encrypted C-based RaaS

Wapack Analysts are researching a C-based Ransomware-as-a-Service (RaaS), that uses AES256 encryption, remains undetected against any antivirus, and is a dangerous ransomware platform being distributed on several, high-profiled underground forums. Unlike other ransomware services that charge users a percentage of the ransom payment, this C-based RaaS charges an up-front fee to use the service. It provides three packages for RaaS services; all which provide access to a C-based Fully Undetectable (FUD) ransomware and a crypter with TOR based C&Cs and panel.

Wapack Labs has cataloged and reported extensively on ransomware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

ATM Access For Sale in Spanish Underground

An underground seller is marketing ATM maintenance manuals, access keys/codes, and private software for a major ATM manufacturer on an underground Spanish language forum. The seller claims to be an ATM mechanic, working in Mexico. This ATM information could compromise several, major Mexican banks. The ATM manufacturer has a presence in over 130 countries and provides hardware / software for banking and retail systems.

Wapack Labs has cataloged and reported on ATM hacking in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

WWW.WAPACKLABS.COM

Russian Keylogger Persevers: Intelligence Assessment

On 24 January 2017, Wapack Labs began collecting keylogger data associated with a threat actor's email address. All of the collected data that was associated with the threat actor indicated that the keylogging campaign has not yet become operational. Metadata contained within the keylogger output indicated the threat actor is located in Western Russia. A screenshot of the threat actor, installing a cracked copy of a popular keylogger program, indicates it was obtained from a Russian underground forum. The actor makes white-supremacist references, but it is unknown if the references are indicative of the threat actor’s motivations or intended to mislead/insult malware researchers...READ MORE

Wapack Labs has reported extensively on Russian threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

TLP: AMBER

ACTOR TYPE: (II)

SERIAL: IA-002-2017

COUNTRIES: XZ

INDUSTRIES: N/A

REPORT DATE: 20170210

Early Warning of a Russian Keylogger Campaign

On 24 January 2017, Wapack Labs began collecting keylogger data associated with a threat actor's email address. All of the collected data that was associated with the threat actor indicated that the keylogging campaign has not yet become operational. Metadata contained within the keylogger output indicated the threat actor is located in Western Russia. A screenshot of the threat actor, installing a cracked copy of a popular keylogger program, indicates it was obtained from a Russian underground forum. The actor makes white-supremacist references, but it is unknown if the references are indicative of the threat actor’s motivations or intended to mislead/insult malware researchers. 

Wapack Labs has reported extensively on Russian threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal in the Red Sky Alliance Portal.

TLP: AMBER
ACTOR TYPE: (II)
SERIAL: TR-021-2017
COUNTRIES: XZ
REPORT DATE: 20170127

Insider Trading in the Underground

Wapack Lab research has uncovered an underground forum with experienced grey and black hat hackers and coders who specialize and host an “Insider Trading” sub-forum. A variety of hackers and coders make their skills available in the various rooms. The forum claims to have a robust vetting process in place to preclude script kiddies, law enforcement, journalists, IT researchers, and “lurkers.” The Insider Trading forum claims to take advantage of talented users with expertise in advanced math, economics, quantum theories, and business entrepreneurship to facilitate insider trading.

TLP: GREEN
ACTOR TYPE: (V)
SERIAL: TR-017-2017
COUNTRIES: ANY
REPORT DATE: 20170125

Russian Hacker Forums - Skimmer Sales

www.cdn.com

ATM skimmer sales, on Russian Internet, are happening both on underground forums and stand-alone sites and blogs. These sales are often sophisticated operations involving high quality materials and providing covert international shipping, thus enabling cybercrime around the world. In addition to skimmers, the same actors often sell encoders as well, which are used to create duplicate credit cards. Some of these sales operations have been active for several years and have built a reputation among their customers by receiving positive reviews and providing a security deposit.

Publication date:                          9 September 2016

Handling requirements:                Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            Criminal; Russian and Russian-speaking

Actor Type:                                   Tier II, III, IV

Potential Targets:                          ATMs (banks and cardholders)

Past Reporting:                              DOC-4097

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.