The Far-Reaching Attacks of the Void Balaur Cybermercenary Group

guest · Nov 10, 2021

Researchers say new group of Russian cyber mercenaries targets 'a mixed bag' — including on its home soil
November 10, 2021
https://www.cyberscoop.com/void-balaur-russian-cyber-espionage/

Trend Micro said on Wednesday it has discovered a new Russian-language cyber mercenary group that has been going after targets ranging from Russian businesses to journalists and politicians.

Researchers discovered the group after a long-time target of the Russian intelligence-connected hacking group Pawn Storm, also known as Fancy Bear and APT28, reached out in March of 2020 saying his wife had been targeted with phishing emails. Trend Micro found that the indicators didn’t match Pawn Storm and attributed the attacks to another Russian-language group it’s named Void Balaur.
Click to expand...

Unlike APT28, Void Balaur appears to be an independent group willing to hack into the emails of targets as diverse as aviation companies in Russia to human rights activists in Uzbekistan.

“Their targets are really a mixed bag,” lead researcher Feike Hacquebord said in an interview. “It looks like a lot of different customers are using them and that that matches with our impression that they are actually a cyber mercenary that can just be hired by about anyone.”
So far, TrendMicro researchers have uncovered more than 3,500 targets of the group. The hackers largely focus on organizations that can provide large sets of personal data, including mobile operators and in vitro fertilization clinics.

“Our research revealed a clear picture: Void Balaur goes after the most private and personal data of businesses and individuals then sells that data to whomever wants to pay for it,” Hacquebord wrote in the report.
Click to expand...

TrendMicro also with “medium confidence” ties Void Balaur to espionage against Uzbek journalists and activists, a campaign that traces back to a year before Void Balaur first started advertising online in 2017.

Data sold by the group, which advertises under the name “Rockethack” on Russian-speaking underground forums, includes Russian passport information, Russian airport passenger data, Interpol records and Russian tax records.
Click to expand...

Trend Micro: The Far-Reaching Attacks of the Void Balaur Cybermercenary Group

As cyberattacks have become a common tool in the offensive arsenals of powerful organizations, an industry has developed that is based around providing cyberattack services, tools, and even training to potential customers.

Void Balaur, which we believe has been active since 2015, primarily dabbles in cyberespionage and data theft, selling the stolen information to anyone willing to pay. During our inquiry into Void Balaur’s activities, we found that the group had targeted over 3,500 victims, some of which bore the brunt of persistent and repeated attacks.
Click to expand...

Our research paper, titled Void Balaur: Tracking a Cybermercenary's Activities, provides a deep dive into the group’s activities, offerings, targets, connections with other threat actors, and the potential consequences its attacks might have on its victims.
Click to expand...

guest · Nov 14, 2021

Trend Micro Exposes Void Balaur Cyber Mercenary Group
November 14, 2021
https://borncity.com/win/2021/11/14/trend-micro-entlarvt-cyber-sldnergruppe-void-balaur/

It's a trend that's been around for a while: fit IT professionals are hiring cyber mercenaries to carry out cyber attacks. Trend Micro has now exposed a cyber mercenary group called "Void Balaur." New research details the modus operandi of the contract hacking group. Motivated by espionage and financial interests, these contract hackers have targeted more than 3,500 companies and individuals since 2015. Among the victims are human rights activists, journalists, politicians, and technical executives in telecommunications companies.

The report from Japanese security vendor Trend Micro sheds light on the activities of a group of actors calling themselves "Rockethack", which Trend Micro refers to as "Void Balaur" – named after an evil, multi-headed creature from Eastern European folklore.
Click to expand...

Trend Micro findings
Trend Micro associates thousands of indicators with Void Balaur, which is also available to enterprises as part of its comprehensive threat intelligence. Most often, the group uses phishing tactics, sometimes including data-mining malware such as Z*Stealer or DroidWatcher.

In addition, the group offers to hack email accounts without user interaction. However, it is unclear how it manages to do this – for example, with the help of insiders or via a compromised email provider.
Click to expand...

"Cyber mercenaries are an unfortunate manifestation of today's cybercrime," said Feike Hacquebord, senior threat researcher at Trend Micro.

Trend Micro has published reports such as Void Balaur and the Rise of the Cybermercenary Industry and The Far-Reaching Attacks of the Void Balur Cybermercenary Group with details.
Click to expand...

Log in or Sign up

The Far-Reaching Attacks of the Void Balaur Cybermercenary Group

guest Guest

guest Guest

Log in or Sign up

The Far-Reaching Attacks of the Void Balaur Cybermercenary Group

guest Guest

guest Guest

Useful Searches