April 11, 2024

Read on for highlights from DarkOwl’s Product Team for Q1, including new exciting product features. The team is starting the new year off strong and looks forward to an exciting 2024!

Enhanced Forum Structuring

The team made upgrades to forum structuring within the platform, empowering users with unparalleled insights into darknet forums. This latest development enables users to navigate darknet conversations in a structured manner, presenting discussions in chronological order for accurate and effortless reconstruction. The upgraded search capabilities further empower users to pinpoint relevant information swiftly, facilitating comprehensive analysis. 

Access to forum data in a structured format is particularly crucial for organizations seeking to bolster their cybersecurity defenses and proactively address emerging threats.  

Figures 1 and 2 (left to right): Previous view of a thread versus new enhanced view

Last month, the DarkOwl Marketing team sat down with DarkOwl’s Director of Client Engagement, Caryn Farino and Product Manager, Josh Berman to learn more. You can read that interview here.

Access the Darknet Safely and Securely Directly from DarkOwl Vision

This quarter the team released “Direct to Darknet” within Vision UI in partnership with Authentic8, a leading provider of cloud-based secure browsing solutions. This feature allows users to further investigate Vision UI search results on forums, marketplaces, and other Onion sites. This can be helpful for an investigation to view the original website, view images or advertisements that may be on the sites, take a screenshot for reporting, and more. By combining DarkOwl’s comprehensive darknet database and monitoring capabilities with Authentic8’s Silo cloud browser, which is known for its secure browsing environment, organizations will gain unprecedented visibility and protection against cyber threats surfacing on the darknet.

Context and Enrichments

The team has significantly increased context information for leaks, actors, ransomware, and has added features to make doing research easier than ever. 

• On the new Leak Explore page, customers can see information about our leak dataset and get information about an individual leak. Customers can look for a leak that we have in our system, see if it’s relevant to them, pivot to the filetree or original posting, and look at the underlying data. We highlight some of leaks we collected this quarter in the next section – all of the information highlighted below is taken directly from this feature. 

• Tox ID search and Compare features (Tools/CVEs) have been added to Actor Explore profiles. The compare feature on the Tools and CVEs page allows users to see commonalities between actor groups, including timelines and any commonalities between actor groups. 

• Site Context on Ransomware search results provide site names, relevant dates, cipher information, and pivoting options to Actor Explore or further research, all provided by the DarkOwl analyst team. 
• The DarkOwl analyst team has added several new Search Block translations in Arabic, Russian, and Chinese languages. 

More Vision UI Updates

• Multi-Factor Authentication login option for customers
• Alert section enhancements to delete single alerts and display Category in the main table. This makes alerts easier to use and more functional. “Category” has been added as a new column on the Alerts page to more effectively use these tags to organize alerts. One way to use these tags is to classify alerts by organization or category such as “Credentials,” to view related alerts from multiple monitors together. 

Collection Stats

This quarter showed tremendous growth in data collection. The team had 5% growth quarter over quarter in added Tor documents, 27% growth in I2P documents, 31% growth in ZeroNet documents, 15% growth in records from Telegram, to highlight a few.

Highlights

Chat platform collection continues to grow as darknet threat actors migrate to darknet adjacent sites. Currently, the platform has coverage of more than 22,000 channels across multiple chat platforms.

The team added 117 data leaks this quarter alone, many of which were requests from customers, which the team always prioritizes. A select few of those are highlighted in the next section – all gathered from the DarkOwl analyst team.

Actor Explore continues to grow – with a total of 307 actor profiles able to searched, compared, and researched within the platform.

Leaks of Interest Collected

As mentioned, the descriptions below are all available in our Leak Context product feature.

Naz.api 

The naz.api leak was made available on BreachForums, on January 15, 2024. According to the post, it is a 35 GB collection of public URLs, usernames and passwords. The post also notes that it was originally on xkey.info but was taken down for allegedly not being the real naz.api leak. naz.api is one of the largest credential stuffing lists originally posted in September 9, 2023 by 0x64. According to that post, the database was created by extracting data from stealer logs, and contains over 1 billion unique records of saved logins and passwords in users’ browsers. The post also notes that the original naz.api dataset was donated to 0t.rocks. Infostealer logs are files produced when a trojan is installed on a system that collects information from the infected system. Depending on the infostealer malware, the extracted data can include system information and browser session data (including autofills, credentials, financial information, cookies, browser history, etc.). Some malware will also capture stored local files and install keylogging on the system to exfiltrate data outside of the browser sessions.

USA 500K SSN

Data purported to be of US Social Security numbers was posted on LeakBase, a hacking forum, on September 11, 2023. Data exposed includes full names, dates of birth, social security numbers, and physical addresses. Analyst Note: Three leaks with “500K SSN” included in the leak name were identified during a recent review, with each leak containing the same data format. These leaks may have been parsed from a larger historical leak and reposted in several parts. For this data leak, DarkOwl noted references to the same sample data dating back to December 2021, supporting this leak contains older content. Notwithstanding, given the presence of social security numbers, the recirculation of this data is of concern.

DC Health Link

Data purported to be from DC Health Link was posted on BreachForums, a hacking forum, on July 22, 2023. According to the post, this breach occurred in March 2023. Data exposed includes member names and IDs, policy information, social security numbers, full names, dates of birth, e-mail addresses, phone numbers, physical addresses, employment information, genders, medical records, and other personal identifiers such as ethnicity and citizenship status. Analyst Note: Review of the original post on Breach Forums on March 9, 2023, indicates the original leaker was thekilob. This is further supported by commentary in the Telegram Channel, BreachForums Chat, where they indicate thekilob was removed as a reference from the original post. Analyst Note 2: DC Health Link made a public statement about the breach on their website on March 14, 2023, detailing information about the breach.

AT&T 

Data purported to be from AT&T was posted on BreachForums, a hacking forum, on March 17, 2024. According to the post, AT&T’s database was hacked by ShinyHunters in 2021 and contains 70 million lines. Data exposed includes names, e-mail addresses, phone numbers, physical addresses, social security numbers, and dates of birth. Analyst Note: According to the information provided in the post, in order to link the SSN and DOB for each record, one will need to grep and replace the encrypted values for these fields in the master file with unencrypted value of these fields provided in a separate file. Analyst Note 2: DarkOwl notes to replicate this connection in the raw indexed files, a search will need to be run using the encrypted value in quotes as the keyword to locate both documents in the leak (i.e. “1lpxFgIp7MlY” would result in both the document that contains the full record with the SSN encrypted value and the file which contains the decrypted SSN value). Analyst Note 3: A high level review of the data indicates the data is from customers in the United States. Analyst Note 4: Research in DarkOwl Vision indicates the data was initially posted for auction on August 22, 2021, for $80,000.

---

Curious how these features can make your job easier? Get in touch!