wazawaka – Computer Security Articles

U.S. Offered $10M for Hacker Just Arrested by Russia

December 4, 2024 admin aleksandr ermakov, boriselcin, daryna antoniuk, Intel 471, mikhail lenin, mikhail matveev, mikhail shefel, Ne'er-Do-Well News, rescator, shtazi-it, sugarlocker, wazawaka

Credit to Author: BrianKrebs| Date: Wed, 04 Dec 2024 14:08:45 +0000

In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as “Wazawaka,” a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Independent Krebs

The Not-So-Secret Network Access Broker x999xx

July 3, 2024 admin Breadcrumbs, cobalt strike, cobaltforce, constella intelligence, dashin2008@yahoo.com, Flashpoint, Intel 471, kirtsov@telecom.ozersk.ru, lockbit, maksim georgievich kirtsov, maksya@icloud.com, maxnmalias-1@yahoo.com, mikhail matveev, Ne'er-Do-Well News, operation endgame, osint.industries, ozersk technological institute national research nuclear university, Recorded Future, u.s. department of justice, wazawaka, x999xx, Кирцов Максим Георгиевич

Credit to Author: BrianKrebs| Date: Wed, 03 Jul 2024 16:41:34 +0000

Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is “x999xx,” the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.

Independent Krebs

Russian Hacker “Wazawaka” Indicted for Ransomware

May 16, 2023 admin babuk ransomware, boriselcin, hive ransomware, lockbit ransomware, mikhail pavolovich matveev, Ne'er-Do-Well News, orange, ramp, uhodiransomwar, wazawaka

Credit to Author: BrianKrebs| Date: Tue, 16 May 2023 21:33:43 +0000

A Russian man identified by KrebsOnSecurity in January 2022 as a prolific and vocal member of several top ransomware groups was the subject of two indictments unsealed by the Justice Department today. U.S. prosecutors say Mikhail Pavolovich Matveev, a.k.a. “Wazawaka” and “Boriselcin” worked with three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies.

Independent Krebs

Wazawaka Goes Waka Waka

February 14, 2022 admin #babuk, A Little Sunshine, babuk ransomware, biba99, boriselcin, Cisco Talos, cve-2021-20028, dmitry smilyanets, groove ransom, mikhail pavlovich matveev, Ne'er-Do-Well News, orange, RaidForums, ramp, ransomware, sonicwall vpn, teresacox19963@gmail.com, tox, verified, washington metropolitan police department, wazawaka

Credit to Author: BrianKrebs| Date: Mon, 14 Feb 2022 18:22:38 +0000

In January, KrebsOnSecurity examined clues left behind by “Wazawaka,” the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since “lost his mind” according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance, and publishing bizarre selfie videos taunting security researchers and journalists. In last month’s story, we explored clues that led from Wazawaka’s multitude of monikers, email addresses, and passwords to a 30-something father in Abakan, Russia named Mikhail Pavlovich Matveev. This post concerns itself with the other half of Wazawaka’s identities not mentioned in the first story, such as how Wazawaka also ran the Babuk ransomware affiliate program, and later became “Orange,” the founder of the ransomware-focused Dark Web forum known as “RAMP.”

Independent Krebs

Who is the Network Access Broker ‘Wazawaka?’

February 2, 2022 admin 902228, abakan, abaza, Breadcrumbs, constella intelligence, cs-arena.org, darkside, ddosis.ru, devdelphi@yandex.ru, domaintools, Flashpoint, initial access broker, kopyovo-a, lockbit, mikhail matveev, mikhail mix matveev, mix@devilart.net, mixfb@yandex.ru, Ne'er-Do-Well News, ransomware, uhodiransomware, wazawaka

Credit to Author: BrianKrebs| Date: Wed, 12 Jan 2022 05:17:31 +0000

In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene.