2easy now a significant dark web marketplace for stolen data

guest · Dec 21, 2021

December 21, 2021

A dark web marketplace named '2easy' is becoming a significant player in the sale of stolen data "Logs" harvested from roughly 600,000 devices infected with information-stealing malware.

"Logs" are archives of data stolen from compromised web browsers or systems using malware, and their most important aspect is that they commonly include account credentials, cookies, and saved credit cards.
Click to expand...

2easy launched in 2018 and has experienced rapid growth since last year when it only sold data from 28,000 infected devices and was considered a minor player.

Based on an analysis by researchers at Israeli dark web intelligence firm KELA, the sudden growth is attributed to the market's platform development and the consistent quality of the offerings that have resulted in favorable reviews in the cybercrime community.
Click to expand...

Cheap and valid logs
The logs are made available for purchase for as low as $5 per item, roughly five times less than the average Genesis prices and three times less than the average cost of bot logs on the Russian Market.

Moreover, based on actor feedback analysis from multiple dark web forums, 2easy logs consistently offer valid credentials that provide network access to many organizations.
Besides the cost and validity, 2easy’s GUI is user-friendly and powerful at the same time, enabling actors to perform the following functions on the site: [...]
Click to expand...

The RedLine plague
Each item purchased on 2easy comes in an archive file containing the stolen logs from the selected bot.
The content-type depends on the info-stealing malware used for the job and its capabilities, as each strain has a different focus set.

However, in 50% of the cases, the sellers use RedLine as their malware of choice, which can steal passwords, cookies, credit cards stored in web browsers, FTP credentials, and more, as shown below.
Click to expand...

KELA: 2easy: Logs Marketplace on The Rise

As part of KELA’s continuous monitoring of communities and markets in the cybercrime underground, KELA identified a rise in the activity of a relatively new market of stolen user information, called “2easy”. The market is an automated platform where different actors sell “logs” – data and browser-saved information harvested from machines (bots) all over the world infected with information-stealing malware. Currently, the market offers information stolen from almost 600,000 bots.

Based on analysis of the data collected by KELA’s systems from this market, as of December 2021, the market hosts 18 sellers offering their infostealer logs for sale. Investigation of these sellers’ activities in the cybercrime underground, as well as feedback about the market posted to dark web sources, indicates that the market has a certain recognition among cybercriminals that deal with stolen credentials; they provide mostly positive feedback.
Click to expand...

Log in or Sign up

2easy now a significant dark web marketplace for stolen data

guest Guest

Log in or Sign up

2easy now a significant dark web marketplace for stolen data

guest Guest

Useful Searches