Intel 471 – Computer Security Articles

U.S. Offered $10M for Hacker Just Arrested by Russia

December 4, 2024 admin aleksandr ermakov, boriselcin, daryna antoniuk, Intel 471, mikhail lenin, mikhail matveev, mikhail shefel, Ne'er-Do-Well News, rescator, shtazi-it, sugarlocker, wazawaka

Credit to Author: BrianKrebs| Date: Wed, 04 Dec 2024 14:08:45 +0000

In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as “Wazawaka,” a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Independent Krebs

Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach

October 18, 2024 admin A Little Sunshine, CrowdStrike, data breaches, equation corp, FBI, hackread, infragard, Intel 471, national public data, Ne'er-Do-Well News, netsec, RaidForums, tecmundo, tv globo, usdod

Credit to Author: BrianKrebs| Date: Fri, 18 Oct 2024 12:33:51 +0000

Brazilian authorities reportedly have arrested a 33-year-old man on suspicion of being “USDoD,” a prolific cybercriminal who rose to infamy in 2022 after infiltrating the FBI’s InfraGard program and leaking contact information for 80,000 members. More recently, USDoD was behind a breach at the consumer data broker National Public Data that led to the leak of Social Security numbers and other personal information for a significant portion of the U.S. population.

Independent Krebs

The Not-So-Secret Network Access Broker x999xx

July 3, 2024 admin Breadcrumbs, cobalt strike, cobaltforce, constella intelligence, dashin2008@yahoo.com, Flashpoint, Intel 471, kirtsov@telecom.ozersk.ru, lockbit, maksim georgievich kirtsov, maksya@icloud.com, maxnmalias-1@yahoo.com, mikhail matveev, Ne'er-Do-Well News, operation endgame, osint.industries, ozersk technological institute national research nuclear university, Recorded Future, u.s. department of justice, wazawaka, x999xx, Кирцов Максим Георгиевич

Credit to Author: BrianKrebs| Date: Wed, 03 Jul 2024 16:41:34 +0000

Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is “x999xx,” the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.

Independent Krebs

Stark Industries Solutions: An Iron Hammer in the Cloud

May 23, 2024 admin A Little Sunshine, andrey nesterenko, arbor, as44477, blue charlie, Breadcrumbs, callisto group, coldriver, comcast cable communications, computer technologies institute ltd, constella intelligence, correctiv.org, ddos-for-hire, ddosia, dfyz, dfyz_bk@bk.ru, don chicho, egihosting, ESET, federal state autonomous educational establishment of additional professional education center of realization of state educational policy and informational technologies, green floid llc, information technology laboratories group, innovation it solutions corp, integrated technologies laboratory, Intel 471, Internet Research Agency, itl llc, jeffrey carr, lockbit, max tulyev, mercenaries team, mirhosting, netassist, netscout, noname057(16), perfect quality hosting, pq hosting plus s.r.l., prolocation, proxyline, raymond dijkxhoorn, Recorded Future, richard hummel, russia's war on ukraine, seaborgium, serverius-as, spamhaus, stark industries solutions, surbl, team cymru, ukrinform

Credit to Author: BrianKrebs| Date: Thu, 23 May 2024 23:32:43 +0000

Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government and commercial targets in Ukraine and Europe. An investigation into Stark Industries reveals it is being used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia.

Independent Krebs

How Did Authorities Identify the Alleged Lockbit Boss?

May 13, 2024 admin 3k@xakep.ru, 7.9521020220, A Little Sunshine, antichat, Breadcrumbs, Cerber, constella intelligence, d.horoshev@gmail.com, dmitrij ju horoshev, dmitry yuriyevich khoroshev, exploit, icq number 669316, Intel 471, khoroshev1@icloud.com, lockbit, lockbitsupp, Ne'er-Do-Well News, nerowolfe, pin@darktower.su, putinkrab, ransomware, Ransomware as a Service, sitedev5@yandex.ru, stairwell.ru, tkaner.com, u.s. department of the treasury, verified

Credit to Author: BrianKrebs| Date: Mon, 13 May 2024 11:26:27 +0000

Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit’s leader “LockBitSupp” claims the feds named the wrong guy, saying the charges don’t explain how they connected him to Khoroshev. This post examines the activities of Khoroshev’s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years.

Independent Krebs

Who’s Behind the SWAT USA Reshipping Service?

November 6, 2023 admin A Little Sunshine, apathyp, apathyr8@jabber.ccc.de, Breadcrumbs, constella intelligence, gezze@mail.ru, gezze@yandex.ru, Intel 471, ivan sherban, mynetwatchman, Ne'er-Do-Well News, swat usa drop service, triploo@mail.ru, universalo, verified, Web Fraud 2.0

Credit to Author: BrianKrebs| Date: Mon, 06 Nov 2023 13:51:31 +0000

Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today’s Part II, we’ll examine clues about the real-life identity left behind by “Fearless,” the nickname chosen by the proprietor of the SWAT USA Drops service.

Independent Krebs

Why Malware Crypting Services Deserve More Scrutiny

June 21, 2023 admin +7.9235059268, Breadcrumbs, cdek, constella intelligence, crypt[.]guru, gumboldt@gmail.com, Intel 471, kerens, kolumb, masscrypt@exploit.im, Ne'er-Do-Well News, obelisk57@gmail.com, pepyak@gmail.com, sergey y purtov, sergey yurievich purtov, spurtov@gmail.com, vip crypt, Web Fraud 2.0, Сергей Юрьевич Пуртов

Credit to Author: BrianKrebs| Date: Wed, 21 Jun 2023 18:39:36 +0000

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. In fact, the process of “crypting” malware is sufficiently complex and time-consuming that most serious cybercrooks will outsource this critical function to a handful of trusted third parties. This story explores the history and identity behind Cryptor[.]biz, a long-running crypting service that is trusted by some of the biggest names in cybercrime.

Independent Krebs

Ask Fitis, the Bear: Real Crooks Sign Their Malware

June 1, 2023 admin 165540027, 774748@gmail.com, akafitis@gmail.com, Breadcrumbs, code-signing certificates, constella intelligence, DomainTools.com, featar24, fitis, Flashpoint, glavmed, Intel 471, konstantin evgenievich fetisov, megatraffer, Ne'er-Do-Well News, o.r.z., Spamit, spampage@yandex.ru

Credit to Author: BrianKrebs| Date: Thu, 01 Jun 2023 16:15:34 +0000

Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software. This post is a deep dive on “Megatraffer,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015.

← Previous