Hackers for hire targeted hundreds of institutions, says report

guest · Jun 9, 2020

Hackers for hire targeted hundreds of institutions, says report
Researchers found 28,000 web pages set up to steal passwords from elected officials, lawyers and journalists
June 9, 2020
https://www.irishtimes.com/business...undreds-of-institutions-says-report-1.4274537

A hackers-for-hire group dubbed “Dark Basin” has targeted thousands of individuals and hundreds of institutions around the world, including advocacy groups, journalists, elected officials, lawyers, hedge funds and companies, according to the internet watchdog Citizen Lab.

Researchers discovered almost 28,000 web pages created by hackers for personalised “spear phishing” attacks designed to steal passwords, according to a report published on Tuesday by Citizen Lab, part of the University of Toronto’s Munk School.

“We see them again and again in areas where business and politics is contentious,” said John Scott-Railton, the lead author of the report, who said the hackers were “brazen, they seem to think they are untouchable”.
Click to expand...

Attacks
The report said the hackers-for-hire group used to conduct the attacks was linked “with high confidence to an Indian company, BellTroX InfoTech”, a technology consultancy which advertised services such as “cyber intelligence” with the slogan “you desire, we do!”

Citizen Lab said the “sophistication of the bait content, specificity to the target, message volume, and persistence across time varied widely”.
Click to expand...

Citizen Lab: Dark Basin - Uncovering a Massive Hack-For-Hire Operation

Key Findings

Dark Basin is a hack-for-hire group that has targeted thousands of individuals and hundreds of institutions on six continents. Targets include advocacy groups and journalists, elected and senior government officials, hedge funds, and multiple industries.

Dark Basin extensively targeted American nonprofits, including organisations working on a campaign called #ExxonKnew, which asserted that ExxonMobil hid information about climate change for decades.

We link Dark Basin with high confidence to an Indian company, BellTroX InfoTech Services, and related entities.

Click to expand...

guest · Jun 10, 2020

Who is Sumit Gupta, the founder of BellTroX
June 10, 2020
https://www.businesstoday.in/curren...pta-the-founder-of-belltrox/story/406526.html

Though Sumit Gupta has denied any wrongdoing, his chequered past -- he was charged by US authorities in a hacking case in 2015 -- and the tracking of hacking operations by Dark Basin alleges he could be the mastermind behind several hacking cases.

Gupta runs his company from a small place in Sant Nagar area of Burari, New Delhi. Its LinkedIn profile suggests BellTroX InfoTech Services has grown into one of the world's premier transcription and digital dictation provider for numerous "hospitals, clinics, expert witnesses, independent practitioners and commercial organisations".
It also offers a "cost-effective, accessible solution" to its clients at "unbeatable prices".
Click to expand...

guest · Jul 29, 2020

Kaspersky: New hacker-for-hire mercenary group is targeting European law firms
The Deceptikons group is the second major hacker-for-hire mercenary group exposed this year after Dark Basin
July 29, 2020
https://www.zdnet.com/article/kaspe...cenary-group-is-targeting-european-law-firms/

Russian cyber-security firm Kaspersky said today in a webinar that it discovered a new hacker-for-hire mercenary group that appears to have been active for almost a decade.

The group, which Kaspersky codenamed Deceptikons, has primarily targeted law firms and fintech companies, according to Kaspersky malware analyst Vicente Diaz.
The Kaspersky researcher said the group appears to be focused on stealing business and financial secrets, rather than government-related information.
DECEPTIKONS DOESN'T USE ZERO-DAYS

"The group is not technically sophisticated and has not, to our knowledge, deployed zero-day exploits," the Russian security firm said today in a separate written report that accompanied its webinar.
Diaz said Kaspersky would be publishing a more complete technical report on Deceptikons activities in the coming weeks.
Click to expand...

SECOND HACKER-FOR-HIRE GROUP EXPOSED THIS YEAR
This is the second major hacker-for-hire mercenary group that came to light this year after Citizen Lab exposed Indian firm BellTroX InfoTech Services as the group behind the Dark Basin APT.
Kaspersky did not link Deceptikons to any real-world entity, however. At least, for the time being.
Click to expand...

guest · Sep 12, 2020

Hacker-for-hire groups profit by commoditizing APT tactics
September 9, 2020
https://www.scmagazine.com/home/sec...oups-profit-from-the-commoditization-of-apts/

In the span of just over three months, researchers have exposed three mercenary, “hacker-for-hire” groups engaging in industrial espionage and stealing corporate secrets for profit.

Despite using tactics, techniques and procedures that are more typical of a nation-state ATP group, these threat actors – Dark Basin, DeathStalker and an unnamed third entity group detailed late last month by Bitdefender – appear to have no government sponsor. Instead, they offer their cyber spying services to the highest bidder, in the form of organizations or individuals who seek intelligence on their business competition or their perceived enemies.

In a recent white paper, Bitdefender said it this “commoditization of APT groups” is “likely to become the new normal.”

“The fact that more security vendors have started seeing these APT-style tactics and techniques being used suggests that this could be the latest trend and a natural evolution towards APTs-as-a-service,” said white paper co-author Liviu Arsene, global cybersecurity analyst at Bitdefender, in an interview with SC Media.
And if that’s true, companies may not be ready for it – especially smaller ones.
Click to expand...

Brandon Hoffman, CISO at at Netenrich, believes several factors may be behind the emergence of these latest mercenary hacking entities.

“Most notably is the success these groups have. The more success mercenary groups have the more skilled people will turn to this type of operation,” said Hoffman.
The increased availability of APT-style tools may be another factor. In some cases, the mercenaries might even be state-sponsored actors looking to make an extra buck during their spare time.

Dark Basin, DeathStalker and the group exposed by Bitdefender each exhibits its own unique targeting and attack behavior.
Who is actually contracting them?

“Since the motives behind these attacks can’t usually be tied to global economic or political events, but rather to specific interests, it’s only a matter of speculation as to who could have backed the operation,” said Arsene.
Click to expand...

guest · Oct 7, 2020

Cyber-Espionage Group BAHAMUT Responsible for “Staggering” Number of Attacks
October 7, 2020
https://www.infosecurity-magazine.com/news/cyber-espionage-bahamut-staggering/

Cyber-espionage group BAHAMUT is involved in a “staggering” number of highly-sophisticated attacks against government officials and major industries alongside a range of disinformation campaigns, according to a new report from BlackBerry.

The tech firm said that the group’s motivation is primarily political, targeting high ranking government officials and industry titans in India, the Emirates and Saudi Arabia, as well as advocates of Sikh separatism or those support human rights causes in the Middle East.
The research indicates that the scope of the group’s activities is much wider than previously thought
Click to expand...

BlackBerry: BlackBerry Uncovers Massive Hack-For-Hire Group Targeting Governments, Businesses, Human Rights Groups and Influential Individuals

BlackBerry today released new research highlighting the true reach and sophistication of one of the most elusive, patient, and effective publicly known threat actors – BAHAMUT. In the report, BlackBerry researchers link the cyberespionage threat group to a staggering number of ongoing attacks against government officials and industry titans, while also unveiling the group’s vast network of disinformation assets aimed at furthering particular political causes and hampering NGOs.

The report, BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps, provides new insights into the group, and shows how it deployed a vast array of sophisticated disinformation campaigns.
Click to expand...

guest · Nov 12, 2020

Mercenary APT group CostaRicto hits organizations worldwide
Uncovered: APT 'Hackers For Hire' Target Financial, Entertainment Firms
November 12, 2020
https://www.csoonline.com/article/3...to-hits-organizations-all-over-the-world.html

Security researchers from BlackBerry Research are tracking a cyberespionage group dubbed CostaRicto whose targets are unusually varied, indicating that it's selling hacker-for-hire services to other entities. The group uses its own custom-built malware and a complex network of proxies, VPNs and SSH tunnels to hide its activity.

"Mercenary groups offering APT-style attacks are becoming more and more popular," the BlackBerry researchers said in their report. "Their tactics, techniques, and procedures (TTPs) often resemble highly sophisticated state-sponsored campaigns, but the profiles and geography of their victims are far too diverse to be aligned with a single bad actor’s interests."
The Sombra, or SombRAT, backdoor is written in C++ that has a plugin architecture. The malicious tool supports some 50 different commands, but is primarily used to execute additional independent payloads or its own plugins, kill processes, collect system information, upload files to the command-and-control (C2) server and other simple actions.
Click to expand...

"Although in theory the customers of a mercenary APT might include anyone who can afford it, the more sophisticated actors will naturally choose to work with patrons of the highest profile—be it large organizations, influential individuals, or even governments," the BlackBerry researchers said.
Click to expand...

Blackberry: The CostaRicto Campaign: Cyber-Espionage Outsourced

During the past six months, the BlackBerry Research and Intelligence team have been monitoring a cyber-espionage campaign that is targeting disparate victims around the globe. The campaign, dubbed CostaRicto by BlackBerry, appears to be operated by “hackers-for-hire”, a group of APT mercenaries who possess bespoke malware tooling and complex VPN proxy and SSH tunnelling capabilities.
Mercenary groups offering APT-style attacks are becoming more and more popular.

Outsourcing an espionage campaign, or part of it, to a mercenary group might be very compelling, especially to businesses and individuals who seek intelligence on their competition yet may not have the required tooling, infrastructure and experience to conduct an attack themselves.
Click to expand...

guest · Jul 25, 2022

Hackers for Hire: Adversaries Employ ‘Cyber Mercenaries’
The Atlas Intelligence Group – or AIG or Atlantis Cyber-Army
July 21, 2022

A for-hire cybercriminal group is feeling the talent-drought in tech just like the rest of the sector and has resorted to recruiting so-called “cyber-mercenaries” to carry out specific illicit hacks that are part of larger criminal campaigns.

Dubbed Atlas Intelligence Group (A.I.G.), the cybergang has been spotted by security researchers recruiting independent black-hat hackers to execute specific aspects of its own campaigns. A.I.G., also known as Atlantis Cyber-Army, functions as a cyber-threats-as-a-service criminal enterprise. The threat group markets services that include data leaks, distributed denial of service (DDoS), remote desktop protocol (RDP) hijacking and additional network penetration services, according to a Thursday report by threat intelligence firm Cyberint.

“[A.I.G.] has introduced us to out-of-the-box thinking,” Cyberint’s Shmuel Gihon wrote in the report.
Click to expand...

The report’s author, Gihon, said only A.I.G. administrators and the group’s leader—dubbed Mr. Eagle—know fully what the campaign will be and outsource isolated tasks to hired guns based on their skillsets.
Anatomy of a Threat Group
Researchers took a deep dive into how A.I.G. operates, communicates and manages its operations, as well observed the specific cybercriminal services it offers.
Click to expand...

Cyberint: Atlas Intelligence Group (A.I.G) – The Wrath of a Titan

The group has been growing rapidly since the beginning of May, and currently advertises its content on several popular marketplace Telegram channels, along with its own Telegram channels. In all their campaigns, they target countries from all over the world, including the U.S, Pakistan, Israel, Colombia, and the Emirates, as they focus on government and other state assets.
Click to expand...

When observing most threat groups, the pattern is clear: The groups often recruit individuals with certain capabilities that they will have to reuse, and everyone gets involved in the campaign.

Atlas has introduced us to out-of-the-box thinking. It appears that only the admins and the leader know fully what the campaign will be. In order to do so, they hire “cyber mercenaries” for different tasks during the phases of the campaign through their Telegram channel (Figure 4, 5). For example, we were able to find open contracts for one job only (without joining the team) for spear phishing and social engineering experts. Another example is publishing contracts for web hacking individuals. It seems that for each campaign they recruit a different set of individuals.
Click to expand...

guest · Aug 10, 2022

The Business of Hackers-for-Hire Threat Actors
August 10, 2022

Cybercrime has entered a new era where people don't steal just for the thrill of doing it anymore. They make it their business to carry out illegal cyber activities in small groups or individually to earn business from online criminals, selling offensive services like spyware as a service or commercial cybersecurity.

For instance, a series of new DDoS for Hire are commoditizing the art of hacking and reducing the barrier to launching DDoS attacks.
Who are Hackers-for-Hire?
Hackers-for-hire are secret cyber experts or groups who specialize in infiltrating organizations to acquire intelligence in one way or another. They offer their services to people who encounter problems when trying to break into an organization for various reasons, for example, lack of skills necessary for the operation or simply because they cannot do it by themselves.
Click to expand...

Hackers-for-Hire Emerge as A Threat
Since 2020, Hackers-for-hire has had unprecedented access to computer networks and have posed as hackers and users contracted to perform different kinds of work for them.
How Hack-For-Hire Operations Work
To get a general overview of the whole process, we can break everything down into three phases that make up a surveillance chain. The first phase involves reconnaissance, where hackers will gather as much information about their target's company or business as they can by using various tools and techniques. This informative phase will then inform phase 2, where hackers will carry out attacks to damage their target.
Click to expand...

guest · Nov 24, 2022

Hackers modify popular OpenVPN Android app to include spyware
By Ionut Ilascu @Ionut_Ilascu - November 24, 2022

A threat actor associated with cyberespionage operations since at least 2017 has been luring victims with fake VPN software for Android that is a trojanized version of legitimate software SoftVPN and OpenVPN.

Researchers say that the campaign was "highly targeted" and aimed at stealing contact and call data, device location, as well as messages from multiple apps.
Click to expand...

VPN service impersonation
The operation has been attributed to an advanced threat actor tracked as Bahamut, which is believed to be a mercenary group providing hack-for-hire services.

ESET malware analyst Lukas Stefanko says that Bahamut repackaged the SoftVPN and OpenVPN apps for Android to include malicious code with spying functions.
To hide their operation and for credibility purposes, Bahamut used the name SecureVPN (which is a legitimate VPN service) and created a fake website [thesecurevpn] to distribute their malicious app.
Click to expand...

All fake apps included code observed only in operations attributed to Bahamut in the past, such as the SecureChat campaign documented by cybersecurity companies Cyble and CoreSec360 [1, 2].
It is worth noting that none of the trojanized VPN versions were available through Google Play, the official repository for Android resources, another indication of the targeted nature of the operation.

Connecting Bahamut to other threat actors is a tall order considering that the group relies greatly on publicly available tools, constantly changes tactics, and its targets are not in a particular region.
Click to expand...

Some threat actor groups Bahamut has been associated with include Windshift and Urpage.
Click to expand...

ESET: Bahamut cybermercenary group targets Android users with fake VPN apps

By Lukas Stefanko @LukasStefanko - November 23, 2022
Malicious apps used in this active campaign exfiltrate contacts, SMS messages, recorded phone calls, and even chat messages from apps such as Signal, Viber, and Telegram

The Bahamut APT group typically targets entities and individuals in the Middle East and South Asia with spearphishing messages and fake applications as the initial attack vector. Bahamut specializes in cyberespionage, and we believe that its goal is to steal sensitive information from its victims. Bahamut is also referred to as a mercenary group offering hack-for-hire services to a wide range of clients.
Click to expand...

Log in or Sign up

Hackers for hire targeted hundreds of institutions, says report

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hackers for hire targeted hundreds of institutions, says report

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches