Blog Archives

DarkOwl CTO, Ramesh Elaiyavalli, on Cybersecurity within Insurance

Written by DarkOwl Content Team on June 24, 2022. Posted in Blog.

2022 OnRamp Insurance Conference Recap

June 24, 2022

OnRamp Insurance is a yearly conference that brings leaders in the insurance, tech, and insuretech space together to accelerate innovation across the insurance industry. This year’s conference was held in Minneapolis at the Allianz Stadium, which was an incredible venue. The event was well represented by various insurers – ranging from large corporations to startups to investors and industry experts.

As a first time attendee, I was pleased with the turnout and quality of lasting connections made. Since one of the primary aims of the event is to provide a platform for integrations and partnerships showcasing various technology and data providers, I was invited to speak on the panel “Cybersecurity within Insurance.” I was so pleased to be able to attend and represent DarkOwl, introducing why the darknet data is an essential part to any sort of risk modeling in the cyber insurance or underwriting space.

State of the Union: Cybersecurity Landscape is Shifting

The insurance industry is going through a tremendous shift. Insurers are subject to increased risk, given a variety of geo-political factors. COVID-19 has exposed an increased attack surface for many companies, due to employees working remotely and exposing sensitive corporate data on unsecured home networks.

In addition to this we have seen a tremendous growth in cyberattacks, data breaches and ransomware compromises. The Ukraine conflict has significantly increased supply chain risk to various markets and insurance space is especially at the receiving end to this heightened risk. All these factors lead to a perfect storm.

Panel: Cybersecurity within Insurance

It was a great to see that cybersecurity is starting to become a repeated theme amongst the insurance industry. I was glad to represent DarkOwl and participated in the panel: “Cybersecurity within Insurance,” alongside representatives from Trust Stamp and Paladin Cyber.

In our discussion, I defined DarkOwl’s approach to risk modeling and loss mitigation specifically for Insurtech. Every entity in the value chain of the insurance space is being disrupted – from brokers to underwriters to carriers – all the way to reinsurers. Each of these is finding ways to apply technology and data sciences to mitigate risk and improve outcomes. Automated underwriting and straight-through processing is taking center stage as companies innovate in the insurtech space.

Insurance carriers, underwriters and reinsurers are forced to find new ways to write policies, factoring in such risks and update policy-writers. There is a clear and present need to get rid of the check list-based underwriting to an automated and risk-based underwriting. We see a need for darknet data and a quantitative and risk-based underwriting at scale for insurers to thrive in this new world order. Similarly to how the FICO score transformed the mortgage industry to underwrite loans, the insurtech space needs a comprehensive risk score to underwrite. And, such a risk score needs to assess darknet exposure to measure risk at scale – not just as a snapshot in time score but a score that is constantly and continuously updated based on the dynamic nature of exposure and threat actors.

“Just like the FICO score set the industry standard on [the insurance market] and underwriting, we believe that the exposure score on the darknet is going to be a simple numeric number that quantifies a company’s exposure and therefore, risk.”

Ramesh Elaiyavalli on “Cybersecurity within Insurance” Panel

Final Takeaways

Risk profiles for organizations have changed significantly. Assessing and modeling risk in 2022 is very different compared to 2019. Be aware of the changes in threat and attack surfaces.

Underwriting screams for automation. There is a clear need for automation, straight through processing and machine learning.

Specialty insurance space is evolving. Nontraditional insurance such as Medical Malpractice, Travel Insurance, embedded (eCommerce) insurance are in high demand.

Darknet data can contribute to risk modeling and assessment at every phase. This data is unique, differentiating, and external insight for various insurers to improve outcomes and mitigate risk.

OnRamp and gener8tor have seen significant growth. Attendees and interest for this insurance-focused event continue to rise. In person events provide the opportunity for significant connections and partnerships.

Overall, DarkOwl received very positive feedback on its business model, products, and platforms. Adding to the conversation around insurance and cybersecurity, led to an increased awareness of our roll as a leader in the darknet data market, as well as our position as thought leaders in the information security space.

Interested in meeting with us at a future event? Check out where we will be this year and request time here.

Dark Web Cyber Group Spotlight: SiegedSec

Written by DarkOwl Analyst Team on June 15, 2022. Posted in Blog.

The new criminal gang specializes in leaked data and digital defacement

June 27, 2022

Read the latest on SiegedSec’s activity relating to the Roe v. Wade overturn in our developing blog, “Darknet Economy Surges Around Abortion Rights.”

June 15, 2022

DarkOwl analysts regularly follow “darknet threat actors” that openly discuss cyberattacks and disseminate stolen critical corporate and personal data. Such analysis helps DarkOwl’s collection team direct crawlers and technical resources to potentially actionable and high-value content for the Vision platform and its clients.

SiegedSec: A New Cyber Threat Actor Group

Since Russia’s invasion of Ukraine and the subsequent, first-ever global cyberwar, several new offensive cyber cells have surfaced. Many of the groups have a strictly hacktivist mission – knocking commercial and government organizations across Russia offline – while other groups piggyback on the collective energy of widespread offensive cyber operations to successfully fulfill more sinister cybercriminal or purely selfish objectives for personal gain.

One new cyber cell, appearing coincidently days before the invasion, has named its operation under the SiegedSec and adopted variations of the tagline, “sieging their victim’s security.” The group, led by a renowned hacktivist using the moniker YourAnonWolf, has quickly progressed in lethality by increasing the group’s volume of victims announced in recent months.

Defaced and Leaked Data

Quick takeaways:

Since their formation in late February 2022, DarkOwl analysts have observed SiegedSec provide proof of the defacement and/or compromise of at least 11 websites with rather juvenile and crude language and graphics included in the defacements.
In April, the group claimed they had successfully defaced over 100+ domains offering proof of a hosting chat dialogue indicating the account passwords had been changed and the defacements corrected, but the group hinted they still had access to the domains.
DarkOwl analysts also discovered several thousand compromised LinkedIn profiles with references to SiegedSec.

There is evidence that the group has gained access to sensitive information and leaked emails or leaked databases from at least 30 different companies since their start in February. However, hardly any of the companies announced have released public noticed of cybersecurity incidents since many are smaller businesses or located in non-English speaking parts of the world. The group shows no preference for the industries nor locations of its victims. They have successfully targeted companies across numerous diverse industry sectors around the globe including healthcare, information technology, insurance, legal, and finance. We’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.

In early April, the group’s spokesperson, YourAnonWolf, appeared on the popular discussion forum, Breached Forums leaking databases, documents, emails containing 17 different organizations’ data including usernames, email addresses, and hashed passwords.

The extent of damage caused by cyberattacks conducted by SiegedSec is unknown and many of them have not been mentioned by public news media sources. However, the leaked data shared on their Telegram channel and on deep web forums like Breached could easily be employed by other threat actors to gain access to companies, individuals, and networks by leveraging the private corporate and personal information posted.

Intentions, Motivations, and Shenanigans

As we mentioned earlier, the defacements observed by the group appear to include vulgar language with references to “d*cks and c*mdogs.” The group’s Telegram channel and social media accounts include posts from the members that self-identify as “gay furries” with downright comical slogans like “TEH LULZ CONTINUES!”, “uwu gay furries pwn you”, and “HACK THE PLANET.” Their avatar includes the letters “$ UWU” – imitating a Linux terminal prompt; the “uwu” letters denotes “overwhelmed with cuteness” and is common in the online furry subculture, which anthropomorphize animals with human personalities.

The group has leaked a significant volume of stolen data from compromised networks, but there is no indication the group uses ransomware nor has attempted to sell the stolen data. According to the themes of their social media posts, and the “furry-centric” brand they’ve embodied, the group appears to be motivated by the sheer fun of the experience, the potential clout gained by publicly mocking organizations with insufficient information security controls.

In late May, the group announced they had successfully targeted an India-based online news distribution outlet, called NewsVoir. Shortly after the attack they leaked an archive containing 27GB of documents exfiltrated from the organization’s servers, and another archive of hundreds of gigabytes in size consisting of source code and API data on the servers. Last week, the group claimed on their Telegram channel the media outlet’s website provider, WebGuruz contacted them directly and the group leaked a screenshot reportedly from their chat directly with a WebGuruz representative. In the chat transcript, “Wolf” (YourAnonWolf) intimates their efforts are not all simply fun, games, and ‘lulz’, but they are possibly interested in financial compensation for their campaigns.

SiegedSec Members & Connections with Other “Hacker” Groups

SiegedSec’s Telegram group has limited membership and activity. We discovered a Keybase “team account” that claims the group has 7 active members.

YourAnonWolf – a self-declared “corn god and furry” – is the most prominent and vocal member of the group with the longest darknet history of its public members. Another possible member of SiegedSec is cialulz who describes themselves as a “15-year-old, Security Researcher & Privacy Advocate. Just an anthropomorphic frog with a thing for computers” and openly uses the #SiegedSec hashtag in their social media profiles. Cialulz is also named as affiliated with other cyber cells in historical deep web documents in Vision, including the “OSAMA SEC MEMBERS LIST” from 2021 and mentioned in official rosters for GoonSquad (a.k.a. #WeAreTheGoons) which apparently was quite active carrying out campaigns in 2017. (Source: DarkOwl Vision)

Another moniker mentioned in coordination with SiegedSec is “Sryakarad“, often shortened to “Sry” in darknet chatter. Sryakarad was mentioned specifically as a key contributor to SiegedSec when the group leaked data from another online media firm they compromised in Pakistan, e-paper.pakistan.

In addition to YourAnonWolf, cialuluz, and Sry, other SiegedSec members possibly include echowo (EchoNull7), mkht1, Trav (trav0x90), and webvuln (r00tsauce), although there are preliminary indications that some of these aliases might be alternative accounts for YourAnonWolf or cialulz.

The group also appears to have close associations with GhostSec, a prominent hacking group with an extensive darknet history who has become increasingly popular for their attacks against Russia in the cyberwar. Social media accounts affiliated with SiegedSec and its members often re-share announcements of attacks conducted by GhostSec. DarkOwl also noted overlap in the membership of the groups’ Telegram channels.

On Breached Forums, YourAnonWolf publicly declared that they are a member of both GhostSec and SiegedSec. YourAnonWolf has been historically active conducting campaigns with Anonymous and GhostSec targeting unjust governments and countries known for human rights abuses. They also claim to have been previously affiliated with other groups including: HackersGhost25, AxoSec and BreachSec. The status of these other cyber cells is unclear.

A document shared on Pastebin in early June confirmed the aliases of the possible members identified above, but also criticizes the technical prowess of the group, claiming most of their attacks are basic SQL injection and cross-site scripting (XSS) attacks. The paste compared SiegedSec to Lulzsec, a high-profiled cyber threat group in the early 2010s who similarly initially claimed to have conducted their attacks simply for the “lulz” or laughs, and often mocked their victims for the security flaws they uncovered. The Lulzsec group was comprised of four-young British hackers who infamously successfully targeted the CIA, PBS, Westboro Baptist Church, and Sony gaining significant digital notoriety and infamy.

The group’s members, ranging in age between 18 and 26 years old, were all sentenced in 2013 between 20 and 32 months for violation of the UK’s computer misuse act in conjunction with the cyber campaigns they conducted. Some of its members were banned from the Internet for upwards of two years and spent time in the Young Offender’s Institute to be reformed.

An anonymous response to the paste was uploaded to Pastebin a few days later addressing each of the statements directly, especially those which minimized the skills of the group’s members. In response to criticism for using automated scanners, the author stated automated tools have a purpose and not only “skids” use them, even though the original post did not publicly call SiedgedSec “skids.” The response paste was signed –Unknown (Source: DarkOwl Vision)

Final Thought From Our Analysts

Although they are presently a fairly small-scale operation flying under the radar with little to no reporting by the greater global information security community, the data discovered during our analysis and contained in the leaks from their victims indicate that there are advanced cyber hacktivists involved in the group’s operations.

The similarities between Lulzsec, LAPSUS$, and the new group, SiegedSec are noteworthy – as SiegedSec’s leader, YourAnonWolf uses similar popular hacking culture phrases that LulzSec’s member, Topiary used. History, regardless of real life or virtual events, tends to repeat itself.

DarkOwl assesses that SiegedSec has the potential to evolve into a high-consequential cyber threat, especially if the group starts demanding extortion payments in conjunction with their attacks.

Curious about something you read? Interested in learning more? Contact us to find out how darknet data can shine a light on leaked data.

CONTI Ransomware Ceasefire, Rebrand, or News Media Hype

Written by DarkOwl Analyst Team on June 9, 2022. Posted in Blog.

June 09, 2022

The recent buzz around Conti poses questions about what is really going on with the notorious ransomware group

In late May, information security researchers reported the administrative panel for Conti’s official Tor website, Conti News, was shut down. The service site for negotiations was also offline, prompting widespread social media speculation and news reporting that the infamous ransomware group had disbanded or shutdown.

However, at the same time, Conti’s darknet-based blog – which they primarily announce their victims and leak their stolen data – continued operating without interruption. While the blog did remain live, there was a noticeable decrease in victim announcements during an 8-day window between the 12th and 20th. Other than this brief slow-down in victim shaming, DarkOwl analysts are not aware of the existence of an official statement from Conti indicating their operations have been interrupted. The group continues to post new victims and leak data on their site.

Since May 19^th, Conti has announced 24 new victims as of time of publication.

Recent Victims

Costa Rica declared a state of national emergency May 8^th due a widespread ransomware attack carried out by Conti. The cyber attack started with the Ministry of Finance, and eventually spread to other Costa Rican government agencies including the tax systems. The government refused to pay the $10 million demanded extortion, even after Conti attempted to get Costa Rican citizens to encourage the government to pay the ransom. When that effort failed, Conti simply moved on to attack websites from the Peruvian government.

Since the controversial attacks in Costa Rica, Conti has not slowed its operations and continues to target several corporations located in NATO-aligned western countries. This includes victims from the transportation sector in Europe, such as a popular airline in the UK, a car dealership chain in Norway, and a mega-yacht supplier in Italy.

A Consequential Breach of Trust and Dox of the Team

At the beginning of the war in Ukraine, Conti was one of the first ransomware groups to publicly announce their support of Russia. Almost immediately, a Ukrainian-based ‘security researcher’ took to Twitter to leak Conti’s critical data. The leak contained Conti’s ransomware source code, details of their internal operations, botnet infrastructure, and private jabber chats and PII from members of the team.

Similar leaks followed for members of the FSB-backed Trickbot group, including dossiers of their members. Private chats from TrickBot and internal operations data from Conti showed a strong operational partnership between the two groups. Following the consequences of their pro-Russian stance, Conti retracted their allegiances claiming they “do not ally with any government and we condemn the ongoing war.”

The impact of the group’s internal leaks continue to ripple across the underground and damage the reputation of Conti on the darknet. Technical ‘red-teaming’ materials from the group are consistently circulated and re-shared across popular darknet forums. Recently, rumors emerged that Conti had shifted to using Emotet for its ransomware campaigns after Trickbot’s sensitive information was shared.

Conti’s Public-Affiliation with STORMOUS Group

Another ransomware group to publicly announce their support of Russia’s invasion, STORMOUS, suffered a similar fate to Conti. The group, which operates primarily on Telegram, posted a marketing graphic depicting their and Conti’s logos, solidifying a Russia-aligned partnership. Not long after announcing their pro-Russian stance, their Tor v3 web service hacked and leaked by another group known as Arvin Club.

STORMOUS targeted Coca Cola in late April, but on May 10^th, STORMOUS randomly announced they had suspended operations. They subsequently posted a public apology to their victims, hinting that they would return in the future with bigger attacks against western countries.

NB65 Weaponizes Conti Source Code Against Russia

Network Battalion (NB65) successfully deployed Conti’s leaked ransomware source code with a modified cipher. The group has since carried out over half a dozen or more attacks against targets across Russia.

Most recently, NB65 targeted a several IT/MSPs in Russia by encrypting their network and exfiltrating over 350 GB of data. They claimed to have simply relieved one of the Russian companies of their principal corporate communication information systems, e.g. Teams, replacing the names of channels and groups with “hacked by NB65.”

NB65 wrote on social media:

“Epic failure of incident response…We decided to relieve you of you Sharepoint sites, Azure AD connections, and all of your user OUs. Credential reuse is awesome! Don’t blame Nikolai, he didn’t know. Teams might be struggling.”

Could Conti’s ceasefire be simply a by-product of on-going darknet drama between ransomware threat actors?

A now-removed post on Conti’s victim site dated May 17th suggests there was some drama brewing between Lockbit, Blackcat (a.k.a. AlphaV, alfa) and Conti. The post claimed that affiliates of Lockbit “steal chats and deceive their advertisers” suggesting that AlphaV and Lockbit are scammers.

Shortly after, a Lockbit representative on a darknet forum encouraged ‘salary employees’ of Conti to contact them on qTox to “discuss a mutually beneficial cooperation … with subsequent employment for a more profitable job.”

Классическая информационная пропагандисткая война, кураторы из ФСБ подсказали? Ваши офисы с зарплатными пентестерами разворошили, и вы думаете, что в вашу мусорскую контору пойдут работать нормальные пацаны? Какие же вы профессионалы если в ваших слитых переписках с жабера вы неоднократно пиздаболили своим жертвам о скачанных данных? Как можно верить тем, кто не позволяет адвертам принимать оплату на свой кошелек? Чтобы честно управлять партнёркой нужно быть очень старым? В моём возрасте мне хватает ума не трогать чужие деньги и беречь свою репутацию 3 года. Вы думаете, что после ваших политических игрищ вам перестали платить и попытавшись переманить адвертов с других партнёрок вам будут больше платить? Жалкое зрелище. Приглашаю всех офисных зарплатных сотрудников конти ко мне в токс, обсудим с вами взаимовыгодное сотрудничество, с последующим трудоустройством на более выгодную работу.

[Translation]

“A classic information propaganda war, did the curators from the FSB suggest? Your offices with salary pentesters have been stirred up, and do you think that normal guys will go to work in your garbage office? What kind of professionals are you if in your merged correspondence with jabber you repeatedly fucked up your victims about the downloaded data? How can you believe those who do not allow advertisers to accept payments to their wallet? Do you need to be very old to manage an affiliate program honestly? At my age, I’m smart enough not to touch other people’s money and protect my reputation for 3 years. Do you think that after your political games, they stopped paying you and trying to lure advertisers from other partners, they will pay you more? A pitiful sight. I invite all office salary employees of Conti to my tox, we will discuss mutually beneficial cooperation with you, with subsequent employment for a more profitable job.”

A more recent post on a popular darknet forum suggested that all of this was all hype. Another user stated that the offline panels could simply be an indication that the group was changing their infrastructure.

[Figure Translation]

“Maybe they’re just changing the infrastructure. Some researcher was monitoring one panel, it died, and he began to crack all over the world that Conti quit. The question is who is hyping here…”

It is important to consider that Conti is still precariously caught in the crossfire between running a criminal ransomware empire, and public opinion – which is largely against Russia. Popular pushback against Conti could be a factor in shutting down the Russian-associated brand. Any combination of these might have prompted the group to take a step back from the limelight, regroup, and rebrand. Furthermore, there is always the possibility that law enforcement operations are covertly influencing these events.

In the past, shutting down ransomware groups has proved almost impossible. Following their attack on Kaseya, REvil shut down and REvil affiliates were arrested in the following months. Analysts have confirmed that the REvil gang is back as of April 2022, possibly at the behest of the Kremlin to carry out Russia’s national cyber initiatives. The former ransomware group DarkSide went offline after hacking Colonial Pipeline, only to resurface under new names.

Reports that Conti has shut down or broken up do not mean the threat of this ransomware group and its operators has passed. History dictates that it is common for ransomware groups to re-emerge. It’s possible that, after a period of reorganization and lapse in activity, a Conti-affiliate or Conti-equivalent group will return. Some research suggests that Conti is directly or indirectly linked to other popular ransomware, like AvosLocker, Hive, BlackByte, and Karakurt. AvosLocker and Hive have been extremely active in recent weeks, with Hive following Conti’s attacks against the Costa Rican government by compromising at least 30 servers in Costa Rica’s Social Security Funds program known as CCSS in late May.

DarkOwl will continue to monitor Conti and Conti-affiliated groups. Victim announcements can be pulled using our latest product Ransomware API. Contact us to learn more.

Interview with DarkOwl’s Director of Product on Ransomware API

Written by DarkOwl Content Team on June 1, 2022. Posted in Blog.

June 01, 2022

Sarah Prime, Director of Product Technology, continues to innovate new products that illuminate critical areas of the darknet. We spoke with Sarah to get the latest on DarkOwl’s new product, Ransomware API.

So Sarah, tell us about this product

Our new product is called Ransomware API, which is an endpoint designed to allow organizations to monitor and have insight into ransomware sites on the darknet.

What made you want to develop this endpoint?

We developed it as a direct response to what we were hearing from our customers. We know that our insight and historical perspective into the darknet is unique, and we wanted to make it easy for people to find this critical information about their vendors or clients.

With this API product, content on these sites – including organization mentions – can now serve as an important risk indicator for a variety of use cases.

Tell me more about these ransomware group sites

The sites available via our new Ransomware API are darknet sites where these groups will publish public announcements, as well as links to downloadable content – often in the form of stolen data. We retain all of the ransomware site content in our archive, as part of our darknet data collection, even after it’s taken down.

As we all know, ransomware as a criminal activity has really skyrocketed in the past few years. Ransomware groups have become significantly more sophisticated and organized from a business perspective, and have created their own underground economy. They commonly use advanced economic strategies such as affiliate networks, third party mediation consultants, and referral programs.

Part of the way groups bolster their clout and status as a reliable enterprise is by establishing a brand, which means they will launch a website just like a corporation might on the regular internet. They even gain income via ad revenue like any other website. Except, this is taking place in a criminal setting.

What would a company being mentioned on one of these sites mean?

It depends, but the vast majority of the time it would mean that the company has been successfully compromised as the result of a ransomware attack. There are certain exceptions, such as when a company has been targeted and the ransomware group posted a description of that company and it included a partner organization, for example. However, in that scenario, it would be important for that company to know that its partner had suffered a ransomware attack so that it could deploy appropriate cautionary and defensive measures within its own network.

After it has been targeted and compromised as the result of a ransomware attack, the context in which a company is mentioned can vary from case to case. In some circumstances, a RaaS group may publish a post stating that they have compromised company X, and If that company doesn’t pay up, they will publish all of their data on their website for free to whomever wants to download it. In other cases, they will sell off portions of a company’s data for profit, regardless of whether they had paid their ransom or not.

Image A: Screen capture of a ransomware group posting on the darknet that describes the data obtained from one of their victims

Image B: Screen capture of the same ransomware posting as Image A, as indexed within DarkOwl’s database and seen in Vision UI

If the attack has already happened, why does it matter?

It’s critical to know whether your customers or companies in your supply chain have been subjected to a ransomware attack. If one of your third-party vendors is compromised by a ransomware attack, you don’t want to wait until they’re able to officially inform you to find out – especially considering that their networks may still be inaccessible to them. They may not even be able to effectively inform their partners/clients right away. Similarly, a services provider can monitor their customer base for these attacks, both to assist in their reaction and also to be aware of the risk associated with the attack. Insurance underwriters and reinsurance companies have a need to monitor on an ongoing basis.

In cases where a company has not backed up their data, the records publicized by the criminals can be a means of understanding exactly what data was lost, what is being sold, and what missing records the group may be holding on to.

Who are the most prolific ransomware actors?

The LockBit 2.0 (LB2) ransomware group has the highest number of victims since the start of 2022. In our analysis of ransomware activity since the invasion of Ukraine in early May, we determined LB2 had successfully encrypted over 280 victims, averaging 4.5 victims per day.

CL0P and CONTI were the two next groups with the highest number of victims, but according to open source reporting, CONTI may be in the process of shutting down their operations due to the impact of Russian sanctions, or simply rebranding to lessen public pressure on the group. We’ve also witnessed AlphaV and HiveLeak demonstrate exponential growth in victim announcements in recent weeks.

How does DarkOwl track these groups?

What’s interesting is that ransomware is a uniquely darknet-based phenomenon. By that I mean, its origins are on the darknet, its perpetrators primarily reside on the darknet, and its economy is hosted on the darknet. We are also increasingly seeing RaaS groups opening splinter or parallel operations on darknet-adjacent networks, such as on chat platforms like Telegram.

We’ve been in the darknet space for a long enough time that our analysts have naturally been keeping tabs and in some cases gotten quite close to these networks, so that we’ve been able to maintain access. We’re also deeply familiar with the way in which these groups operate and are able to predict when new groups are gaining prominence, when popular groups are rebranding, when they might be launching new sites, and so forth.

Is there a particular use case that you think Ransomware API is a good fit for?

Any company that has a substantial vendor portfolio and is concerned about supply chain risk. It could also provide an important datapoint for cyber insurance underwriters who need to assess a company’s historical risk. In fact, because ransomware groups will often remove or delete their posts after a certain amount of time, this tool is one of the few – if not the only – that can provide an accurate picture of whether or not a company has been subject of a ransomware attack.

How is this different from our other API products?

This product provides information regarding a very specific use case that customers can use to build whatever they want, including monitoring functionality, auditing services, underwriting assessments, compliance tools, etc. While this is also possible with our other APIs, the targeted scope of this data makes it one of our more streamlined and scalable products.

What else makes this product special?

This product is built on dynamic data sources; as ransomware groups evolve, so does our data coverage. We can also track specialty groups upon request, so it will be interesting to see what kind of growth there is in coming months as we continually add new ransomware sites to our collection.

Anything to look forward to from DarkOwl team? What is the product team excited about?

Yes! We always have a lot going on, but the biggest thing on the horizon from the product team is the development of a new DARKINT scoring model. It’s showing a lot of early promise in identifying heightened risk, making it an even more comprehensive measure of an organization’s darknet exposure. This is critical for risk assessment, risk monitoring and rating efforts.

Where can people learn more?

To stay aware of ransomware group activity, I recommend keeping up with the research that our analysts publish regularly. Their latest piece, which is fascinating coverage RaaS group activity since the invasion of Ukraine, can be found here.

To learn more about Ransomware API, please reach out to schedule a demo with our sales and product teams.

View Ransomware API Product Page and Ransomware API Datasheet.

The Darknet Economy of Credential Data: Keys and Tokens

Written by DarkOwl Analyst Team on May 26, 2022. Posted in Blog.

May 26, 2022

In this blog, we review how sensitive, server-side access credential data – such as AWS private/secret keys, Django secret keys, and API tokens – are captured, circulated, and sold across darknet marketplaces and criminal communities.

Darknet Background

The darknet, which is also referred to as the dark web, is a segment of the internet that is only accessible by using specialized software or network proxies. Due to the inherently anonymous and privacy-centric nature of the darknet, it facilitates a complex ecosystem of cybercrime and illicit goods and services trade. Adjacent to the darknet is the deep web and instant chat platforms that play an increasing critical role in facilitating this illicit information availability. Pseudo-anonymous discussion forums and vendor marketplaces hosted on the deep web along with Telegram private and public channels provide additional platforms by which threat actors communicate and circulate sensitive and stolen credential data.

There are multiple types of underground criminal communities that are directly involved in the circulation of stolen credential data. The threat actors from these communities are often categorized as:

Initial Access Brokers: specialize in providing direct access to organizational networks to conduct offensive cyber campaigns. Access is offered for sale on darknet malware discussion forums and exploit marketplaces.
Database Brokers: specialize in exfiltration of large datasets from compromised organizations. Databases are traded and sold on darknet marketplaces and Telegram channels.
Nation-State Sponsored / Cyber Criminal Gangs: these groups are intent on conducting cyber operational campaigns in fulfillment of geopolitical or military initiatives, cyber espionage, and/or information operations. Some gangs are also financially motivated and will extort the victim for financial payments once keys have been leverage for access and theft of sensitive data.

There is also the odd and less publicized ‘hacker skid’ or hobbyist hackers that will scour the darkest corners of the Internet for server-side credential data for simply the psychological thrill of the hunt. These threat actors do not have direct intent for monetary gain, nor even probable use, but seek to feed their egos and increase their personal clout by stealing keys and communicating their various levels of illegal access to high-profile criminal groups and hacking enthusiast communities and chat servers.

Critical Credential Data

This blog is focused on server-side credential data for development and cloud-based server assets. Credential data is also referred to as username/email-address and password combinations, which will not be discussed here.

There are several types of “keys” that threat actors are interested in obtaining:

Amazon Web Service (AWS) Key Management Service (AWS KMS) Access Keys: ‘poweruser’ and administrator encryption keys for the managing Amazon-hosted services.
AWS Identity Access Management (IAM) keys: consist of long-term credentials users will use to sign programmatic requests to AWS Command Line Interface (CLI) or AWS API.
Azure Keys & Secrets: Credential data stored inside Azure Key Vault (KV). Data includes database connection strings, account keys, passwords, and JSON Web keys.
Django SECRET_KEYs: secret key for a particular Django installation that is used to provide cryptographic signing.
Google Key Management System (KMS) Customer Managed Encryption Keys (CMEK): project-id’s and private keys for service accounts on the Google Cloud Platform (GCP)
API Keys: keys required for any number of application programming interfaces

Unfortunately, the threat actors do not always delineate types of keys they’ve obtained or are offering. Many times the threat actor simply advertises the platform and the word “key” in the forum post or marketplace advertisement.

Key Compromise

Commercial application developers have been guilty of copying and pasting keys in organizational Github repositories that are publicly accessible via automated web scrapers. Malicious threat actors actively hunt for such keys across software repositories and unprotected s3 buckets and then utilize the keys for malicious campaigns or trade in the darknet. Sometimes such exfiltrated data is stored on transient paste sites prior to distribution, that is captured by DarkOwl.

A recent example of a ‘dump’ of secret server keys is demonstrated in the figure below. These were discovered by simply using DarkOwl’s proximity search to find documents where the words ‘AWS’ and ‘key’ are within two words of each other.

Figure 1: Source DarkOwl Vision

Some threat actors offer zero-days on malware-centric Telegram channels and darknet discussion forums that facilitate the scanning of Gitlab and Github. In early 2021, a user on AIO Crime, using the moniker soapceo, offered a 0day for searching private repositories for AWS keys for $10K USD.

Figure 2: Source DarkOwl Vision

Other malicious actors employ malware, such as information stealers (a.k.a. infostealers) to steal session tokens and keys. Infostealers such as Redline, Jester, and Eternity – often installed onto victim devices via malicious email campaigns – covertly log and exfiltrate sensitive data from the victim’s device to cause additional harm.

According to open-sources, information security researchers have identified similar information stealer malware in the wild, such as TeamTNT_AWS_Stealer that specifically targets virtual/cloud platforms to exfiltrate sensitive AWS keys on Kubernetes and Docker clusters adjacent to the compromised container.

DarkOwl identified malware called Laravel Monster that is advertised as an “all-in-one grabber” that exfiltrates AWS keys “and more” offered on a popular Russian-speaking forum. The malware also includes a built-in AWS checker that validates whether the keys harvested are active and live and could be used to compromise the server.

Figure 3: Source DarkOwl Vision

For reference, in early 2022, we observed another example of a “Git Scanner” malware is included from the exploit forum for $4K USD to $8K USD depending on the features of the software. A YouTube video demonstrating the software is also included in the post.

In April 2022, a user posted an offer on Telegram for something called, “INJECTOR V3” and a hacking guide known as “Amazon AWS SMTP Method 2022.”

It’s unclear what the details of this method entail (as we did not purchase it); however, other chatter on Telegram suggests it “cracks” AWS servers, uses the server to carry out malspam email campaigns, e.g. phishing, and may even harvest data while on the server.

Figure 4: Source DarkOwl Vision

Keys on Offer

DarkOwl has observed sensitive credential data and keys on offer across the darknet and adjacent chat platforms known for facilitating cyber-crime. Darknet and deep web forums popular for discussing critical credential data, e.g. keys include many of the malware-specific forums such as XSS. Many times the mention is in relation to “how to exploit” what they’ve discovered on the compromised cloud asset, while others are offered “for sale” in the ACCESS section of the embedded marketplace in the forum.

Darknet threat actors utilize Jabber XMPP and Telegram services in conjunction with their accounts on malware discussion forums to communicate directly with their customers and/or provide more detail about their use of malware they’ve developed or are on offer.

Some threat actors have dedicated “public” Telegram channels where services and digital goods are offered for sale. DarkOwl has observed keys for sale on darknet forum threads and Telegram channels. Many offers on Telegram include offers for keys to simply increase their credibility in the space and encourage customers to do business with them.

Figure 5: Source DarkOwl Vision

While many keys are captured via the methods mentioned above, sensitive SDK API keys are often stolen during organizational cybersecurity incidents, and then circulated by groups on the darknet and in Telegram channels. In summer of 2021, the Electronic Arts (EA)’s FIFA software servers were compromised by a cybercriminal gang, and the data is still in circulation.

Figure 6: Source DarkOwl Vision

Sometimes a discovered or stolen key is utilized to access a cloud or platform panel and the threat actor offers the ‘panel’ for sale. In late 2021, a Telegram market, known as “The Grand Exchange” advertised an Azure panel on offer for sale. The advertisement references a deep web marketplace for the vendor.

Figure 7: Source DarkOwl Vision

Many API keys in circulation on the darknet are offered for free. DarkOwl has observed several recent software API keys offered for free on popular commercial-accounts-trading Telegram channels.

In 2020, a Telegram channel user states they have a Binance API key they obtained via information stealer malware.

In March 2021, an initial access brokers advertised sensitive credential data and cloud access AWS “root” keys for a USA company on a popular darknet malware development forum. The keys were on sale for $80K USD and the threat actor included the revenue estimates for the company and AWS bills to justify the cost of the keys in correlation to the potential ransomware extortion values.

Figure 8: Source DarkOwl Vision

DarkOwl has observed API keys for sale on darknet discussion forums and adjacent Telegram live chat platforms. Both Raidforums and its newest reincarnation, Breached Forums have included such offers on their sites. The figure below is an example of Raidforums user on Telegram offering to sell a Coinbase Pro API key for malicious access. How the API key was obtained is unclear.

Figure 9: Source DarkOwl Vision

DarkOwl has observed threat actors offering sell access to “logs on darknet marketplaces, such as Russian and Genesis. Such logs are obtained via stealer malware variants and include session tokens and keys obtained from victim devices.

Databases of stealer logs that may include API tokens and sessions are also offered for sale and trade on deep web forums such as Breached Forums.

Curious about something you read? Interested in learning more? Contact us to find out how darknet data applies to your use case.

Pardon Me While I Steal Your Cookies – A Review of Infostealers Sold on the Darknet

Written by DarkOwl Analyst Team on May 19, 2022. Posted in Blog.

May 19, 2022

Overview: Information Stealers (or ‘infostealers’)

In recent months, DarkOwl has observed an increase in the number of posts advertising a specific type of malware known as “information stealers” or simply, ‘infostealers’ by the underground cybercriminal community. Most of the infostealer promotion appears on darknet and deep web malware/hacking forums and are available for sale across many darknet marketplaces.

Information stealers are designed to steal sensitive information from a compromised device. Most information stealers are designed to covertly access the application where data is stored, e.g. internet browser, and gather personal information such as authentication and credential data, crypto wallets, browser session cookies, etc, and remotely transmit the data back to the cybercriminal for conducting additional financially-focused extortion crime.

Infostealers are commonly delivered by social engineering, such as malspam campaigns and phishing emails. Attachments are typically included in the email with a lure, or a legitimate-looking trap encouraging victims to open the attachment and install the malware onto their device. Information stealers are on the rise and promise lucrative business opportunities for cyber criminals.

In this research, our team reviewed some of the most widely proliferated infostealers on offer on the darknet and discovered an elaborate data exfiltration ecosystem, with low-entry cost, providing cybercriminals access to a wealth of personal information without the victim’s knowledge. We also learned many infostealers are offered in alignment with a malware-as-a-service (MaaS) or “stealer-as-a-service” (SaaS) rental model with subscriptions-based access to the malware executables and associated command and control C2 botnets.

Redline

Redline is one of the most popular, widely recommended, and notorious information stealers available on the market. The first advertisement for Redline appeared in March 2020. Redline can be used for exfiltrating credentials, cryptocurrency wallets, browser information, as well as FTP client application data. The stealer also collects information about the victim device, including OS, system hardware, processes, and system language.

According to OSINT security researchers, the stealer can load remote payloads in addition to the SOAP protocol for covert C2 communication. Recent versions of Redline leverage SOAP, or Simple Objects Access Protocol over NET.TCP which helps obfuscate the communication data shared between the victim and the C2 servers. SOAP also facilitates smaller packet sizes, which translates to a smaller malware footprint.

Redline is available on darknet marketplaces like DarkFox for as little as $150 USD for the “lite” version, $200 USD for an advertised “pro” version, or $100 USD for a monthly subscription with restricted access. Other marketplace offers indicate that the Redline team advertise various versions and configurations of their infostealer to support varying levels of threat actor sophistication.

The malware is written in C# and uses a SOAP API to communicate with its C2. Attackers are contacted on Telegram and then can use the C2 panel installed on the victims’ device to use Redline. Redline source code is available on Github with 142 lines of code and built-in commands. (Source: Available Upon Request)

Figure 1: Offer for Redline Stealer for sale on Darkfox Darknet Marketplace

Racoon

According to open sources, Raccoon Stealer, a.k.a Racelar, was first offered for sale in April 2019 and associated with a Telgram user @gr33nl1ght. The Racoon stealer exfiltrates victim login credentials, credit card information, cryptocurrency wallets and browser information. It can also download and execute arbitrary files by command from the C2, operated from Telegram.

DarkOwl has observed advertisements in the darknet for Raccoon offered under the malware-as-a-service model for $75 USD a week or $200 USD per month. Some advertisements on Telegram decrease with longer commitment, e.g. $500 for two months and $499 for four months. The Raccoon stealer executables are available on Github and the source code has been archived in Pastebin.

Despite the success of their operations, in March, the Raccon stealer group announced on a darknet forum they would be suspending operations due to the war in Ukraine and critical team members who are no longer available for key operations.

Figure 2: Raccoonstealer Representative Announcement of Shutdown due to Ukraine-Russia War

Vidar

According to analysts with Cyble, Vidar, also sold as Vidar PRO stealer, was first identified back in 2018. This infostealer variant steals sensitive information such as passwords, banking information, IP addresses, browser history, login credentials and crypto wallets which are sent back to threat actors’ command and control.

The stealer is widely advertised on Telegram and a DarkOwl Vision document captures a Vidar offer on Telegram for $500 USD, but prices on average range from $250 USD to $750 USD for the stealer malware. (Source: DarkOwl Vision)

Vidar is written in C++, and employs Mastadon servers for command and control. An interesting and in-depth analysis of the stealer code can be found on Github details how its stealer infrastructure operates. (Source Redacted but Available Upon Request)

Predator the Thief

Predator the Thief was first offered for sale on a Russian Darknet Forum on June 17, 2018 by a user known as Alexuiop1337. Predator the Thief is more comprehensive than a browser stealer alone and is able to take screenshots of the victim’s desktop in addition to typical exfiltration of credentials, payment data, crypto wallet information stored in the victim’s internet browsers. (Source)

The malware also includes anti-debug techniques, advanced evasion, and anti-analysis tricks for additional sophistication. It is still widely circulated and updated regularly. A Github repository containing the infostealer’s 332 lines of code is still maintained by a user with the same alias as the original post from 2018. (Source Redacted, but Available Upon Request)

The listing is currently offered on darknet forums as well as Telegram channels. The stealer sells for $150 USD, with an option of paying $100 more for the Clipper module allowing buyers to customize crypto wallet stealing options.

Mars

Mars stealer is the most recent version of OSKI stealer and was first seen circulating around July 2021 on a Russian darknet forum. (Source)

During our analysis, we also discovered Instructions for building the Mars’ stealer panel and using the “builder” are available across numerous darknet forums including how to turn off the exclusion for the stealer working in Commonwealth of Independent States (CIS) designated countries. This infostealer is advertised for $160 to $200 USD and is continually under development and improvement complicating Yara rule creation and AV detection.

In early May, users on a darknet forum began circulating a cracked version of the software for use by the community. Many of the forum users warn against using ‘cracked’ versions of the software as there is higher risk of backdoors. We observed that a prominent MarsTeam account which shared some of the original advertisements for the Mars stealer on one popular darknet forum is banned and tagged as a scammer. The ban brings into question the stealer’s legitimacy.

Figure 3: Original post about the Mars Stealer whose Representative has since been banned

Regardless, a GitHub repository containing code for the Mars Stealer is owned by a developer with an impressive collection of various malicious software and other stealers in their repositories, including Loki and Oski stealer as well as Redline. The current version of Mars stealer is using Google Ads to put cloned OpenOffice sites high on search results.

Blackguard

According to open sources, Blackguard first appeared in Russian forums in January 2020 and was advertised “for testing purposes.” The infostealer spent a year circulation before it was advertised for commercial use in 2021. Blackguard steals web browser data like extensions, cryptocurrency wallets, email, messengers, and other sensitive device information that can identify the victim.

Blackguard is sold as a malware-as-service where stolen information is archived into a zip file which is sent back to the C2 server. The source code is developed in .NET and is access is available for $200 USD a month or $700 for a lifetime subscription. (Source)

Acquisition of the stealer is generally limited to exchange with the malware’s representatives directly Telegram and Jabber.

Despite its popularity among cybercriminals and the existence of a cracked version recently in circulation, some dark web forums users are not impressed with this information stealer nor its price tag. Some users recently nominated the Blackguard stealer for the “worst stealer 2020-2022 award” and warn others from using this stealer for legitimate malicious cyber campaigns.

Figure 4: Forum post criticizing Blackguard stealer malware

[Figure Translated]

“The sold software, which is a shame to call a stealer, has already been said a lot. He can officially be nominated for the “Worst Stealer 2020-2022” award Crack taken from the forum where the initial review was posted. It is worth noting that this crack is given “as is”, without fixing holes in the panel. It is categorically not recommended to use it for combat purposes.There is also information that the stealer was so buggy that it fell with exceptions during the crack tests (for example, when getting the av name installed on the machine). These bugs have been fixed by the reverser!”

In other darknet threads, forum users stated that the Blackguard information stealer is “trash”, replete with errors, and requires too much overhead – in the form of persons to operate, especially for the $700 USD price.

Figure 5: Forum post criticizing Blackguard’s lifetime subscription prices

[FIGURE TRANSLATED]

“AHAHAHAHAHAHAHAHAH, $700 sounds more like a rofl than the real price…” That all in all sounds like a big rofl. The author of this software supports the AUE culture and listens to Nurminsky. And now, comrades, answer me one question: how did we come to this. AUE coder. It is 2022. Is this what we deserve?”

The criticisms caused quite a controversy with the stealer representative on the forum confronting many users directly and suggesting they take it up with the moderators in Arbitration.

Jester

Jester is an information stealer that Cyble first noticed in darknet forums in July 2021. It targets the victim’s browser cookies, credentials, email clients, instant messaging applications, crypto wallets, gaming software, VPN and FTP client application data. (Source)

Advertisements on a darknet forum advertise that the stealer-C2 connection is encrypted using the AES-CBC-256 algorithm, with servers located in the tor network, all logs will be redirected to the user’s Telegram bot, and collection occurs in memory instead of on disk to evade detection. Jester is available on RuTor with links to pastebin sites explaining what the stealer does and how much it costs in different languages. The “Builder Jester” malware-as-a-service offering is priced based on length of subscription with $99 USD per month and two “forever” options for $250 USD and another for $999 USD.

Cyble suggested a Github owned by user L1ghtM4n linked to the Jester malware, but further investigation shows that user is linked to a repository called DynamicStealer. DarkOwl has not been able to confirm if the two malware source codes are affiliated; however, some very recent reporting suggests that Jester might be affiliated with the Eternity malware family.

Users promoting Eternity deny the connection, but flaunt that Eternity offers not only a cookie stealer, but a cryptocurrency malware variant, a cryptocurrency address clipboard “clipper”, a DDoS botnet, Worm and Dropper system, as well as a ransomware variant. A new Eternity stealer Tor service claims they successfully exfiltrate a considerable amount of information from the victim including Signal contacts and password manager data on the device like LastPass.

Figure 6: Eternity stealer promotional information provided by the threat actor

Taurus

Taurus Stealer, also referred to as Taurus project is an information stealer that has been observed promoted by the authors of the Predator the Thief on Russian chat forums in early April 2020. It can steal VPN, social media, credentials, cookies, autofill forms, popular cryptocurrency wallets, and the history of Chromium and Gecko based browsers. It collects information on installer software installation and system configuration, sending it back to the attacker to be used for further lateral exploits across the compromised machine.

Like Mars Stealer, the source code will not execute on victims located in the CIS region, suggesting the authors are likely located in the Russia Federation.

A lifetime license to Taurus is available for $100 USD and can be customized for as little as $20 USD extra. One advertisement we observed on Telegram offered a 10% discount on license cost and the first update is available for free.

Both Taurus and Predator the Thief use BitsTransfer in their PowerShell commands; Bits Transfer is short for “Background Intelligent Transfer Service”, part of Microsoft’s Operating System, and is a way for programs to ask Windows to download or upload files from a remote HTTP or SMB file server.

Taurus links to download malicious GitHub repositories whereas Predator The Thief PowerShell works with LNK files after the stealer has sent the log. When BitsTransfer is executed in Taurus, it downloads three separate files from the Taurus Project on Github owned by andrewwilm. Github has since removed the repository.

In late December, the source for Taurus stealer + its builder, were leaked on a popular darknet forum. Earlier this week, a darknet user offered multiple software iterations of both Predator the Thief and Taurus for $4K USD in Monero cryptocurrency – stating the code was “straight from the author’s hands.” This implies that both Predator the Thief and Taurus stealers were most likely coded originally by the same person.

Figure 7: Offer of source code for sale for Predator the Thief and Taurus stealer software

[Figure Translated]

“The original source code of the two projects.

Predator: 3 versions (2.3.1/3.0.1/3.3.4 ) + clipper model. The panel is not included.

Taurus 4 versions (1.2/1.3/1.4/1.5). Included panel (frontend vue.js, backend golang), telegram bot builder (golang).

Projects are sold as is, without support and updates. Straight from the author’s hands.

The price for all 4k is $XMR only. We can conduct the transaction through the guarantor of this forum.”

Other Information Stealers

While the stealers mentioned above are the most widely circulated and discussed across the information security community and cybercriminals, we also found other less known stealers that are currently active in the underground.

Ginzo

In late April, we found an “as-is” version of source code for a stealer known as “Ginzo” available to download from a popular third-party anonymous data repository. The Ginzo stealer targets Telegram session data when loaded on a victim’s device, along with Internet browser cookie data, desktop files, cryptocurrency wallet data, and Discord tokens.

Open-source reporting suggests that offering the stealer for free to download is a ploy to gain reputation and “get criminals hooked” on using Ginzo’s threat actors command and control servers.

[TRANSLATION]

“Taken in the vastness of the cart, laid out as is. DLL keys that are thrown with the panel have not been checked.”

Figure 8: Source code for Ginzo stealer offered for download

Grim

Another controversial stealer, called “Grim stealer” hosts its own deep web vendor shop and market offering their stealer for sale. The site claims there is a Telegram scammer which is causing the controversy on darknet forums as they are using the malware team’s logo and pulling a classic case of ‘alias hijacking’ to discredit the stealer’s reputation.

Like Eternity, the Grim shop offers their Grim Noid stealer for $110 USD as well as other products such as: a stealer builder for $60 USD, cryptocurrency clipboard “clipper” for $50 USD, a remote access trojan (RAT) for $100 USD, and botnets for the Surface Web and Telegram for $300 USD.

The technical specifications advertised are consistent with other infostealers on the market.

Figure 9: Grim Noid Stealer offered for sale

The market for information stealers is booming on the darknet, with stealer software variants readily available offering high volume data exfiltration, a relatively low-entry cost, and reliable C2 botnet support.

All the stealer families we reviewed advertise a supportive criminal ecosystem, providing cybercriminals steady access to a wealth of digital tokens and personal information that can be abused for subsequent fraud, digital identity theft, and potentially catastrophic critical infrastructure and supply chain attacks.

Curious about something you read? Interested in learning more? Contact us to find out how darknet data applies to your use-case.

Ukraine’s Call for Help Results in Global Cyberwar: Reviewing the Fallout

Written by DarkOwl Analyst Team on May 12, 2022. Posted in Blog.

May 13, 2022

On the 24^th of February, after months of failed diplomacy, the existing geopolitical landscape of Russia, Ukraine, NATO, the EU, China, and the myriad of complex international relationships drastically changed. Thousands of Russian troops and equipment crossed over into Ukraine’s sovereign territory and missile strikes of critical infrastructure and historical landmarks sent its people deep into bunkers underneath the cities, while other took up arms to defend their country.

While the kinetic war waged in the physical realm, Ukraine’s Ministry of Digital Transformation turned to the digital realm for assistance. Within days of the invasion, a call across underground forums and chatrooms was placed and hundreds of thousands of volunteers – many who identify with the Anonymous hacktivist collective – answered.

Ukraine’s call for help sparked off the first ever global cyberwar.

Weeks before tanks and soldiers marched on the cities of Ukraine, Russia had already carried out a series of successful cyberattacks against Ukraine, hitting critical infrastructure and financial institutions around the country with at least six unique strains of destructive wiper malware. DarkOwl observed data exfiltrated during some of those attacks surface in the darknet, such as the Free Civilian service on Tor where hundreds of gigabytes of Ukrainian citizens sensitive personal data appeared. Recent reporting confirms Russia’s GRU also carried out a massive cyberattack against Viasat, knocking its customers’ KA-SAT satellite broadband offline an hour before the invasion.

Russia’s pre-invasion attacks against Ukraine pale in comparison to the retaliative cyberattacks launched against Russia by the international hacktivist community over the last 77 days. Since the invasion began, thousands of hacktivists, cybersecurity researchers, pen-testers, and ‘greyhats’ are actively participating in daily campaigns to disrupt Russia’s military offensive and influence the perceptions of the Russian people trapped behind the walls of the iron curtain.

Cyber Warriors Use Their Keyboards and Phones as Weapons in Global Cyberwar

Ukraine’s Ministry of Digital Transformation has played a large roll in mobilizing calls to arms from a digital perspective. The IT Army of Ukraine – a digital army of over 275,000 volunteers that was tasked by The Ministry – targets Russian websites every day for widespread distributed denial of service (DDoS) attacks. The Ministry also coordinated directly with SpaceX on acquiring thousands of Starlink terminals for redundant satellite Internet access and spearheaded public calls to international business leaders and retail suppliers to withdraw from operating in Russia.

Hacktivist cyber cells aligned with the Anonymous collective and pro-Ukrainian criminal cyber threat actors conducted hundreds of direct information operations campaigns against Russia using any and every exploit in their arsenal. To this day, the attacks continue relentlessly despite Russia’s attempts to use geo-fencing and Cloudflare services.

Within the first week of the war, we witnessed credentials for numerous critical Russian government ministries leaked on the deep web; the names, phone numbers and personal assets of Russian oligarchy released to the public; names, passports, and dates of birth for over 120,000 Russian soldiers deployed in Ukraine; internal documentation for Russia’s Police Force, Ministries of Foreign Affairs, and Economy leaked.

Darknet criminal communities split over their national alliances. Pro-Russian ransomware groups watched their affiliates abandon their programs and turn on them. We witnessed multiple groups have the internal documentation, source code, and private chats leaked. Several Tor forums and vendor markets hosted in Russia faced persecution through direct cyberattacks, database leaks, and deanonymization of IP addresses.

Propaganda as a Weapon

In any cyberwar, information is power. Knowing that Moscow would try to frame the war as a justified and a defensive strategic military operation, Anonymous worked immediately to identify facts and combat misinformationn. Videos of the attacks against civilian buildings went viral on social media, YouTube, and Discord. Russian television, radio, streaming services were illegally accessed to share images from Ukraine. Anonymous security specialists from Poland known simply as squad303 spun up their 1920.in service – named after a famous RAF squadron involved in WW2’s Battle of Britain – which allowed strangers to contact to a random Russian citizen via SMS, email, Whatsapp, and Viber using leaked lists of millions of Russian citizens’ personal contact information and social media.

As of the first week in May, the squad303 team announced that over 100 million direct messages had been sent using their service.

Figure 1: Screenshot of squad303’s Russian Citizen Phone Number Contact Service

The Kremlin responded by tightening their control on the public media narrative, shutting down social media platforms like Twitter, Instagram, and Facebook, officially calling their war a “special military operation” and using militarized riot police to enforce a strict ban on all forms of public protest of the invasion.

Western media and independent news sources have been threatened with journalists facing a potential 15-year prison sentence for reporting anything that countered Putin’s narrative of “denazification of Ukraine” and “freeing” its people from imminent nuclear threat from the US and NATO. Russian propaganda outlets began recirculating false claims of US-sponsored bioweapon laboratories and nuclear weapon storage facilities across Ukraine to justify the invasion.

Since the invasion, the Russian Internet Research Agency (IRA)-backed ‘troll army’ is in full force with thousands of bot accounts active across Twitter, Facebook, Discord, and Telegram spinning a different story on the ground in Ukraine. The accounts disseminate elaborate storylines of Ukraine shelling their own citizens and supporting fake videos and doctored media.

QAnon and Russian Disinformation
Deep web and darknet imageboards (or “chans”), historically supportive of the QAnon movement and home of the most outrageous conspiracy theories ever told, have also been supportive of Putin touting his critical international role – like that of former President Trump’s – in ridding the world of its secret Cabal and the greedy desires of the New World Order.
According to research shared by Bellingcat, posts on the imageboards in early March stated Russia capturing Ukraine’s Chernobyl plant was critical to stopping everything “from DNA experiments, adrenochrome, torture, childsex and rape facilities, cloning installations and much more.” Ironically, QAnon Russia – with one of the largest QAnon follower base at over 90,000 users – has a dissenting opinion and refuses to share the propaganda, but instead promotes peace in Ukraine, and a united brotherhood across all nations in the region including Belarus, Russia, and Ukraine.

Anonymous retaliated against these coordinated disinformation efforts by hacking Russia’s Roskozmador information and propaganda agency and its All-Russian State Television and Radio Broadcasting Company (VGTRK) and leaked over 900,000 emails and 360,000 files from across the organizations which detail how television and radio are tightly regulated and programs censored directly by the Kremlin.

In anticipation for Russian propaganda expected to be broadcast on Victory Day on May 9^th, Anonymous successfully compromised Russian state television changing nearly every television description during Victory Day ceremonies to read:

“The blood of thousands of Ukrainians and hundreds of their murdered children is on your hands. TV and authorities are lying. No to war.”

Figure 2: Television Program Description from Russian State TV Programming Hack (Source: Anonymous)

Virtual private network (VPN) use in Russia has skyrocketed increasing over 3,000% since mid-February. According to open sources, at least some percentage of curious Russian citizens are bypassing censorship by using VPNs to access international news about Ukraine and social media platforms. As of this week, reports estimated an average of 300,000 downloads of VPN applications occurred every day.

The first fallout in the darknet from the cyberwar was direct attacks against the CONTI ransomware gang shortly after they publicly declared their support for Russia’s invasion. A Ukrainian-based ‘security researcher’ took to Twitter to leak CONTI’s ransomware source code, details of their internal operations, botnet infrastructure, along with private jabber chats and PII from members of the team.

Similar leaks followed for members of the FSB-backed Trickbot group including dossiers of their members.

Several darknet forums, marketplaces, and XMPP chat servers were taken offline, and information leaked in a digital public shaming for each group’s association with Russia.

In March, Kelvinsecurity exploited a simple IDOR vulnerability on the darknet site: DATABASE Market and leaked the contents of the market’s SQL database and deanonymized the server publishing the IP address of their host located in St. Petersburg.

Earlier this month, member of Anonymous known as v0g3lsec hacked a Russian-linked darknet vendor shop and replaced the site’s content with a description of squad303’s information service and link to their surface website.

Figure 3: Tor Service Defacement by v0g3lsec

Network Battalion (nb65) successfully deployed CONTI’s leaked ransomware source code with a modified cipher and has carried out over half a dozen or more attacks against targets across Russia. Their most recent attack involved Qiwi Кошелек Russian payment system, with over 149,000 kiosks and terminals around the country. Earlier this week, the group shared a database containing over 7 million unique credit card numbers and associated PII for Qiwi platform users in Russia.

Critical Infrastructure Attacks

We have not observed a mass disruption of Russia’s critical infrastructure such as gas, power, and water supplies. This is likely because like the US, such systems decentralized and distributed across various districts across the country. However, some limited interruption has been observed during the conflict. In early March, Cyber Partisans utilized industrial control system (ICS) attacks to shutdown trainlines supplying the Russia military in Belarus. Automated ticketing stations were knocked offline and forced the transportation authorities to issue paper tickets causing delays.

Oil and gas related entities in Russia such as: Gazprom Linde, MashOil, Neocom Geoservice, Enerpred, Aerogas, and Technotec have all suffered cyberattacks resulting in thousands of internal Microsoft Exchange email data leaks in the deep web. In late April multiple explosions occurred resulting in catastrophic fires and injuries at Druzhba oil depot. Subsequent open-source reports on Telegram suggest that the explosions at the Transneft-Druzhba Oil Depot supplier for military units were ‘delivered with the help of drones’ from Ukraine. The depot and associated pipeline is the main route for getting Russian oil into its European customers, although EU leaders have signaled a plan to stop purchasing oil from Russia by the end of the year which may lead to a full embargo across the continent.

In recent weeks, several other mysterious fires across the country have been reported including an ammunition depot in Staraya, another ammunition plant in the Russian town of Perm, an Aviation school in the same village of Perm, a government building in Korolev, a chemical plant near the border of Ukraine, an oil depot in Belgorod, a defense research center in Tver, a pro-Kremlin publishing house in Moscow, a storage hangar in the Bogorodskoe district, and oil tanks were set fire in the industrial zone of Nizhny Novgorod.

Another random fire also started in Belgorod less than two days ago. Reports have not specified where the fire originated specifically.

Figure 4: Recent Explosions in Belgorod Captured by Social Media Users (Source: VK)

It is unclear from reporting whether these explosions were a result of SCADA cyberattacks or direct arson and sabotage by Russian locals sympathetic with the situation in Ukraine. The darknet threat group GhostSec recently compromised Russia’s Metrospetstekhnika ASOTP system for transportation and successfully caused dozens of trains connected to the system to cease operation. The group claims they were able to access and disrupt the internal temperature, smoke, and backup battery systems for any of the trains connected to the network.

Figure 5: Announcement of Metro Train Attack by GhostSec (Source: Telegram)

Anonymous Leaks Stolen Data

Within days of the invasion, targeting and exfiltrated data from targets across Russia surfaced in the deep web. DarkOwl has been monitoring mentions and announcements of data leaked in relation to the since the start of the cyberwar and found hundreds of leaks related to numerous government and commercial industrial sectors across Russia, Belarus, and China. The chart below demonstrates the volume of unique URLs observed containing information related to the war. In the early days, much of the leaked information contained network reconnaissance information (IP addresses, domains, credentials) for carrying out attacks against critical targets, and PII for government, military, and citizens of Russia.

As the war progressed, stolen data of all kinds, e.g. intellectual property, design schematics, military plans, financial account data, and emails appeared. While in recent weeks the number of unique leaks are fewer, the contents contained therein are higher volume and significant in value. For example, over the last two weeks, Anonymous has released – via DDoSecrets – over 3TB of data archives containing thousands of emails and sensitive internal documents from victim organizations across Russia.

Figure 7: Distribution of Data Leaks from the Cyberwar by Industry Sector

Nearly 90% of the leaks DarkOwl has observed are related to targets in Russia. The figure below is a distribution of the non-Russian countries information that has surfaced, with direct mention of the cyberwar. The threat actor group, AgainstTheWest (ATW) concentrated on technology, government, and financial targets across China in the weeks following the invasion. ATW has since stopped participating in the campaign.

Figure 8: Percentage of non-Russian Data Leaked with Direct Mention of Global Cyberwar

Russia’s Response Takes Many Forms

Readers should not be fooled into thinking that this data means that Russia is sitting back idly during these attacks. In addition to the crippling Viasat attack the day of the invasion and widespread propaganda dissemination, GRU-affiliated cyber actors have regularly attacked Ukrainian telecommunications and critical infrastructure alongside its ground-based offensives. Elon Musk also recently stated that Starlink satellites in use by the Ukrainian government for Internet broadband access is under frequent targeted signal jamming by Russian-linked hackers.

State-sponsored malicious cyber actors, ransomware and affiliated extortion groups linked to Moscow continue to spray US and western European companies with widespread spear-phishing attacks and malware deployment. During our recent review, we estimate ransomware gangs successfully encrypt on average a dozen organizations per day.

DarkOwl will continue to monitor the darknet and deep web for critical information pertaining to the quickly evolving cyber landscape.

Curious about something you read? Interested in learning more? Contact us to find out how darknet data applies to your use case.

Using DarkOwl Vision to Protect Brand Value and Reputation

Written by DarkOwl Content Team on May 10, 2022. Posted in Blog.

May 10, 2022

This blog discusses how DarkOwl’s software-as-a-service (SaaS) product suite – Vision App, Search API, and Entity API, can be utilized to protect corporate brand reputation and value.

Darknet Background

The darknet – also referred to as the dark web – is a segment of the Internet, hidden by the novice user, that is only accessible by using specialized software or network proxies. Due to the inherently anonymous and privacy-centric nature of the darknet, it facilitates a complex ecosystem of cybercrime and illicit goods and services trade. The most common darknet to date is “The Onion Router” or simply, Tor.

The deep web is a collection of websites that do not require anonymization software to access but require unique knowledge of the URL or account curation and authentication for entrance. While a personal banking account portal is technically in the deep web, much of the deep web facilitates cybercrime through criminal marketplaces and discussion forums.

DarkOwl defines darknet-adjacent networks, such as servers and channels from Telegram, IRC, and Discord as instant-messaging chat platforms featuring real-time communications (or “chatter”) of on-going criminal activity and active cyber operations.

Decentralized Darknet Marketplaces

The darknet is home to decentralized darknet marketplaces (DNM), e-commerce platforms where buyers and sellers transact directly with each other through peer-to-peer networks or the Tor network. Marketplaces usually employ cryptocurrency-based escrow built into the marketplace to facilitate secure and anonymous deals between the buyers and vendors.

One of the first and most well-known darknet marketplaces is the Silk Road, established in 2012 by its founder, “Dread Pirate Roberts” – Ross Ulbricht. Upon its shutdown and for years after, the US government seized an estimated of $1 billion USD in Bitcoin connected to Silk Road.

The seizure of Silk Road and the lifetime sentence of Ulbricht has not deterred criminals from continued illicit goods trade in the darknet. As of time of writing, DarkOwl has knowledge of 30 large-scale decentralized markets currently online and hundreds of smaller single-vendor operated or single-product marketplaces in operation across the darknet and deep web.

Forms of Brand Mentions in the Darknet

Corporations and organization, along with their key leadership, are regularly targeted and ‘mentioned’ in the darknet – across marketplaces, discussion forums, and transient paste sites. Many times, the references are specific to a cyber campaign to target the company while others are perfectly-matched counterfeited goods marketed by underground counterfeiters and resold on darknet decentralized marketplaces.

The most common types of critical brand mentions in the darknet include:

Derogatory Mention by a Disgruntled Customer or Employee
Personal Dox of Corporate Leadership and/or Board Members
Targeting Data in association with Malicious Cyber Operations
Leaked Critical Company Data
Cracked Software Distribution
Pirated Media and Streams
Counterfeit Product Sales

Examples of Corporate Brand Mentions in Vision

Using the common forms listed above, this section provides real-examples of brand mentions in the darknet, deep web, and darknet-adjacent platforms and captured by DarkOwl’s autonomous content crawlers.

A disgruntled employee of Wells Fargo states that the company is ‘scandalous’ and ‘corrupt.’ They also highlight a major cyber risk for the company, where they have been instructed to use other employee’s logins to do their job.

Figure 1: Source DarkOwl Vision DocID: 7f32e227c2590d5c2e04fd0b3e5d051042940641

An employee at Amazon compares tradeoffs NBA players must perform with the harsh working conditions at Amazon corporate (not warehouses).

Figure 2: Source DarkOwl Vision DocID: 136d898fde08e2217c8bf43c26930f1fd7356bd1

A dox (also doxx) is a detailed public record of someone’s identity. To ‘dox’ someone is to publish private information about that person – as a form of public shame and generated to enact revenge on the company or person for some perceived wrongdoing. The dox presents a significant security threat to the company and the individual, with detailed information such as their mobile phone numbers, residential address, social media accounts, bank accounts, and familial associations publicized and subsequently targeted for phishing, fraud, and even kidnapping for murder or extortion.

Every ‘dox’ has a reason for publishing the information to a public record.

Corporate leadership, members of the board of directors, and key figures related to many brands and international entities are regularly targeted for ‘doxing’ in the darknet.

Figure 3: Source DarkOwl Vision DocID: d8ba881fd4f01f8e691a7fcfada1b4ad3ebc7d64

Threat actors identify Gazprom’s subdirectories, subdomains, and IP addresses in preparation for a concerted attack against the oil and gas supplier in retaliation for Russia’s invasion in Ukraine.

Less than a month later, a significant volume of data from Gazprom and its subsidiary, Gazprom Linde Engineering was leaked on the darknet including 768,000 emails from the joint Gazprom-Linde Microsoft Exchange server.

Figure 4: Source DarkOwl Vision DocID: 77be2205969371938bb235f463f94fa32cb4552d

Hacktivists regularly target companies and brands in support of geopolitical and social injustice initiatives.

The image below includes an announcement on Telegram by pro-Ukrainian hackers calling for the boycott of purchasing Nestle products due to their continued operation in Russia and subsequent economic support for the Putin-backed Kremlin.

In the days following the post on Telegram, prominent darknet threat actor group, KelvinSec compromised Nestle’s company network and leaked sensitive databases containing their customers, transaction, and shipping data.

Figure 5: Source DarkOwl Vision DocID: 9b5dde8629bcb38002c81e3d19a47470ebddd263

Figure 6: Screenshot from the actual database leaked from Nestle, consisting of customer entity data, orders, payment information, and passwords (10GB total)

Cybercriminals often leak large sets of company-proprietary and sensitive data obtained via ransomware attack or malware infection of a company’s network. Critical corporate data might include – but is not limited to – software source code, sensitive email communications, employee W2 verification data, identity documents such as driver’s licenses and passport images, and financial statements.

The example below is source code exfiltrated by LAPSUS$ threat actors after a major cybersecurity incident against the SAMSUNG corporation.

Figure 7: Source DarkOwl Vision DocID: f7d9d309d34853f0b1236d437ef1314460b54223

“Cracking” is a broad term used by darknet and deep web threat actors to describe the process of breaking into something, more often bypassing software licenses and passwords required by computer software programs.

Adobe Products are regularly targeted for ‘cracking’ due to steep costs for their software product licenses and subscriptions. Threat actors on Telegram detail how to install ‘cracked’ version of Photoshop and DLL manipulation to override licensing requirements.

Figure 8: Source DarkOwl Vision DocID: 52401ddd38f3386b57b07bfc161d06813d6bd23d

Pirated media, movies, and streams have continued presence on the darknet. The Pirate Bay – considered the “most resilient BitTorrent site” on the Internet still circulates the latest movie titles.

Figure 9: Source DarkOwl Vision DocID: db4dda0c5ab85082b2c6b98c5948f1ad60c162ba

Figure 10: The Pirate Bay BitTorrent Download Landing Page

The illicit trade of counterfeit goods is a multi-billion-dollar international industry – which continues to be led by China. According to Europol, surface web monitoring helps crack down on the major counterfeit goods suppliers, but many sophisticated networks simply shift to the darknet and use decentralized darknet markets to sell their counterfeited items.

Many darknet marketplaces feature a section of “counterfeit goods” that encompasses physical counterfeited items, a buyer can purchase and have sent to them directly. Watches and fine jewelry are the most common physical goods offered on underground marketplaces.

Figure 11: Active Listing for a Counterfeit Ladies’ Panthere de Cartier Watch on Vice City

Marketplaces are more commonly known for their diverse and extensive selection of drugs available for purchase. DarkOwl has witnessed the defamation of many brands in affiliation with common street drugs.

For example, the Warner Bros (WB) entertainment brand has been extensively used by drug dealers on the darknet in the advertisement of “WB-shaped” ecstasy (XTC) pills and their comic-book heroes and cartoon franchises exploited in the distribution of marketed Batman, Superman, and Looney Toons-specific drugs.

Figure 12: Screenshot of Offer Captured in DarkOwl Vision DocID: 1411b1671a1aeedae7c1add5b996d769

Figure 13: Source DarkOwl Vision DocID: 58f39ef647bfdb931f6b8d147cd86b85

DarkOwl Solutions for Brand and Reputation Management

DarkOwl’s SaaS product suite of its Vision App, Search API, and Entity API are designed to help augment surface web monitoring for brand mentions like those discussed and outlined in this document.

In the Vision App, analysts can create automated monitors and alerts to notify when critical corporate information or counterfeited products are circulated in darknet paste, discussions forums, or marketplaces.

Figure 14: Screenshot from DarkOwl Vision’s Search, Monitoring, and Alert Features

Curious about something you read? Interested in learning more? Contact us to find out how darknet data applies to your use case.

All Your Passwords Belong to Us

Written by DarkOwl Analyst Team on May 5, 2022. Posted in Blog.

May 05, 2022

In honor of World Password Day – a date established in 2013 by Intel Corporation to foster security awareness – the content team at DarkOwl decided to compile some interesting statistics based on the email and password entities available in the DarkOwl Entity API.

DarkOwl’s Entity Volume

Every day we hear of another commercial data or app breach. At this point, everyone can assume their email address and/or password has been leaked on the darknet or deep web. DarkOwl has collected and tokenized over 8.68 billion (with a “B”) email addresses. 5.46 billion of those emails include a password. 57% of those email addresses include a ‘plaintext’ or legible password.

But My Password is Complex!

If you’re still using your cat’s name followed by the exclamation point (“Fritzie!”), your password is not complex, and you have most likely already experienced an account compromise. But, you’re not alone. Complex, lengthy passwords are not the norm across DarkOwl’s data.

The most common password length is 8 characters.

Figure 1: Distribution of Password Volume by Password Character Length

Is an 8-character length password strong enough?

The strength of an 8-character password depends on the motivation and the tools available to the cybercriminal targeting your account. There are plenty of password ‘cracking’ tools readily available to hackers to conducting dictionary and brute force style password attacks. Some of the most popular tools include:

John the Ripper
Cain & Abel
OphCrack
THC Hydra
Hashcat
Brutus
RainbowCrack
CrackStation

Even the most sophisticated password crackers will need significant processing power and time to successfully break long, complex passwords. Unless an 8-character password includes numbers and symbols, the password can be potentially brute forced.

Figure 2: Time to Crack Passwords of Varying Degrees of Character Length and Complexity

Over 4 billion of the passwords (4,285,451,030) available in DarkOwl’s Entity API are 32 characters or less. 662,341,057 passwords could be classified as extreme and greater than 32 characters in length.

Figure 2 demonstrates that passwords including numbers and symbols are harder to crack than letters alone. DarkOwl’s data contains a significant volume of passwords with some degree of complexity but only 637 million plaintext passwords would be classified as “strong.”

Strong passwords defined as containing special characters, digits, lowercase, uppercase, and length greater than 8 characters.

Passwords That Age Us

Do you have a favorite year that you include in your password for uniqueness? Perhaps it’s your birthday year or anniversary. Both are very common. We found over 707 million passwords include a year string that starts with “19XX” or “20YY.”

According to our data distribution, peak volumes of passwords include the data range of 1980 to 1994. The most frequent years we observed were:

1990: 14,006,141

1987: 13,795,566

Figure 3: Distribution of Passwords Containing a Date (Year) String

QWERTY is Simply Lazy

The “QWERTY” keyboard layout originated in the late 1860s and was designed to help people type and translate Morse code faster. Regardless of its origins, people heavily rely on the top row of the American keyboard characters in many password fields; 5,793,906 passwords in DarkOwl Entities API contains the6-character string “qwerty.”

Even worse is sequential numbers with 29,010,394 consisting of “123456” and 11,718,471 going to the trouble to add the whole number set, “123456789.”

DarkOwl has collected 5,857,363 passwords using the laziest password of all: the word, “password.”

Hashed Passwords > Plaintext

Billions of leaked plaintext passwords are tragic, no matter the complexity, character length, or whether a date string or qwerty is included. Therefore, if you suspect a plaintext password you use or have used in a commercial webservice has been compromised, change it immediately and cease using it on any authentication logins. Credential stuffing campaigns exploit password reuse and utilize email address and password combinations to attempt logins outside of the source of the original leak.

Given the propensity for commercial data breaches, most authentication and digital identification protection platforms strongly suggest users passwords are stored in a hashed format instead of plaintext to reduce the likelihood of immediate malicious use upon compromise.

6% (518,566,724) of the passwords available in DarkOwl’s Entity API are hashed passwords.

In cryptography, hashing involves using a mathematical algorithm to map data of any size into a bit string of a fixed size. In password hashing, a ‘hash’ consists of a unique digital fingerprint (of a fixed size) corresponding to the original plaintext password which cannot be reversed. There are several different types of ‘hashing algorithms’ available for encrypting passwords.

The most common hash in DarkOwl’s data is MD5 followed by SHA-1.

Some MD5 hashes in phpBB and WordPress appear as 34 characters instead of 32. DarkOwl has 345,431 hashed passwords consisting of 34 characters.

Both MD5 and SHA-1 have been deemed vulnerable as they are subject to collision attacks and dehashing. One of the most popular password hacking programs to date, Hashcat, contains lookup tables for popular wordlists, like RockYou allowing for the original plaintext password to be deciphered.

Password Strengthening Tips

Although you can’t prevent commercial services getting breached and usernames, email addresses, and password combinations getting leaked, you can follow some simple steps to ensure you employ robust password hygiene and reduce the risk of a password getting brute forced or exploited in a credential stuffing campaign.

Use an automated complex password Manager like Lastpass, BitWarden, or 1Password.
Don’t reuse passwords. Have unique password for every login and streaming service you sign up for.
Choose passwords at least 16 characters in length.
Include symbols and numbers for increased complexity.
Avoid using passwords with dictionary words or names.
Don’t use sequential numbers or the word “password”
Don’t use the year of your birth or anniversary in your password.
Turn on multi-factor authentication (MFA) for important accounts like financial and banking sites.

Celebrating World Password Day

Today’s World Password Day is a perfect time to pause and review the security – or lack thereof – of your most common password habits. After reading this blog, we invite to you to consider taking the following actions today:

Review passwords stored in your keychain, password managers, or sticky notes.
Change any passwords you might be reusing across multiple sites.
Share password tips on social media with friends and family.
(#WorldPasswordDay)
Transform a weak password into a strong one using the password strengthening tips above.
Turn on MFA for all important accounts.

Curious about something you read? Interested in learning more? Contact us to find out how darknet data applies to your use case.

Ransomware Resurgence and Emergence: Continued Analysis of RaaS Activity Since the Invasion of Ukraine

Written by DarkOwl Analyst Team on May 4, 2022. Posted in Blog.

May 04, 2022

Ransomware on the Darknet Continues

In the days immediately following the invasion of Ukraine, the ransomware-as-a-service (RaaS) industry on the darknet experienced several high-profile interruptions with many popular RaaS affiliate programs impacted by their partners having to choose between their nationalistic alliances with Russia or Ukraine. Many wondered what impact this would have on the thriving ransomware ecosystem.

A security researcher leaked critical operational data, personally identifying information for threat actors, and sensitive private chats between members of the CONTI RaaS group. The data leak revealed the human side of some of the most prominent RaaS organizations with mentions of personal “visits to the dentist” and recommended songs to listen to on YouTube to pass the time while working on their exploit and attack campaigns.

From an operations perspective, we also learned the critical roles Bazarloader Botnet, Cobalt Strike, and Trickbot played in the long-term success of CONTI’s empire.

Shortly after the leaks emerged, CONTI’s leak site slowed in announcing victims from 10 through 16 March. However, during that same time STORMOUS announced they had compromised Ukraine’s Ministry of Foreign Affairs. Around the same time, Ukraine’s Vodafone network suffered a major cyberattack and was knocked offline.

Figure 1: Netblocks Status of Vodafone, 6 March 2022

The interruption in victim announcements was more like a slow-down and did not last long with a quick ramp up from the major RaaS industry players: CONTI, Lockbit 2, and CL0P announcing dozens of victims during the month of April.

LockBit2 – a gang that “claimed” neutrality in the Russian-Ukraine war – has the highest number of total victims since the 24th of February at 280. That’s an average of 4.5 victims per day by a single group.

DarkOwl is currently tracking 25 active ransomware groups. Across those groups, the total number of victims – just since 24 February – totals 813, presenting an even more worrisome average of 11.8 victims per day.

Figure 2: Scatter plot distribution of daily ransomware victims per RaaS gang

Critical Infrastructure Targeted

Unsurprisingly, victims include several US and NATO-based critical infrastructure organizations and suppliers including local government municipalities, electrical and alternative power providers, water, telecommunications, and transportation suppliers.

DarkOwl also observed an increase in manufacturing and construction-related companies with downstream victims including international lumber and steel processing companies mentioned quite frequently.

CONTI announced last week they successfully encrypted US-based MACK Defense, LLC a major parts supplier and sales organization attached to the MACK trucking company. This will likely cause further interruptions to an already encumbered and fatigued US ground-based supply chain.

Meanwhile, Snatch leaked over a gigabyte of data from a popular European travel website, TUI Group.

Figure 3: CONTI Announcement of Ransoming MACK Defense, LLC

Ransomware groups have announced at least half a dozen victims across electrical, water, or natural gas-affiliated suppliers the US, Canada, and Europe in the last 10 days.

In March, German wind-turbine supplier Nordex suffered a severe cyber incident carried out by CONTI shutting down over 5,000 wind turbines across the country. On April 23rd, CONTI leaked 145GB of exfiltrated data related to the company, archived across 82 compressed data files. The Nordex cybersecurity incident was likely a critical infrastructure retaliation attack for Germany’s support of Ukraine.

HiveLeak and AlphaV’s activity also increased significantly with nearly 100 victims between the two RaaS gangs alone. Vice Society also leaked 20 victims in the last 10 days of April after previously having a relatively slow ransomware

Figure 4: Statement from Snatch Ransomware

The Resurrection of REvil

REvil’s “Happy Blog” suddenly appeared online and operational on April 20th on the Tor network, redirecting to a new URL which announced 5 victims. The last victim posted by the REvil group was in mid-October 2021 shortly before experiencing 404 errors and rumors emerged suggesting the FBI had seized the admin panel had deleted the Tor service using UNKN or another admin’s keys.

According to the BBC, members of the REvil RaaS operation were reportedly taken into custody by the Russian FSB after an international law enforcement operation last December.

The redirected URL includes a link to “Join Us” with a request for affiliates to contact them using a Tox address provided. The advertisement continues their historical 80/20 ransom split and states they have a “Тот же проверенный (но улучшенный) софт” [TRANSLATED] “The same proven (but improved) software.”

Figure 5: REvil’s Latest Call for Affiliate Partners

The new REvil Tor service boasts an odd-mix of victims, including an oil and gas company in India, asphalt production company and a corporate signage company. By the end of the month, the service was offline and inaccessible. The intentions of revitalizing the REvil Tor service is unclear, but the timing was near coincident with the US closing diplomatic channels with Russia on cybersecurity.

The resurrection of REvil could indicate that President Putin has released arrested ransomware operators to carry out retaliatory attacks against critical targets in the US and Europe.

New Ransomware Groups and Patterns Emerge

A new RaaS group called Blackbasta appeared online and announced 11 new victims on the 26th of April. Blackbasta uses the ChaCha20 and RSA-4096 cipher, an upgrade from groups like Maze and Sekhmet that utilized ChaCha20 and RSA-2048 ciphers. They also call their Tor victim’s page, “Basta News” playing off the CONTI marketing strategy.

Figure 6: Blackbasta Tor Service “Basta News” 30 April, 2022

Another new group, Onyx ransomware started leaking their victim data on a Tor service titled, “Onyx News” with 7 new victims added at the end of April. The victims appear to be primarily small businesses and organizations, including a local US police office and a couple of family medical practices.

The x001xs ransomware group appears to have pivoted to a different underground industry with no victims announced since late January. Their Tor service also now redirects to a darknet credit card provider called “BitCarder.”

RaaS group activity across the whole industry has steadily increased over the last 10 days. When visualizing the various groups’ victim announcements as a function of post-date, they demonstrate quite noticeable “peaks and valleys” that suggest less publishing collectively occurs on weekends.

The outlier for this trend is CL0P who drops several groupings of victim announcements only around the weekends. The CL0P group was much less active in March with announcements only at the beginning and end of the month.

Figure 7: Daily Distribution of Total Victims Per Day Across All Groups, with 3pt Moving Average Filter

Ransoming Russia

Since the end of March, an Anonymous-linked, pro-Ukrainian cyber threat cell known as Network Battalion ’65 (or simply nb65) has carried out cyberattacks against Russian entities using ransomware. The group allege they are deploying a variation of the leaked CONTI ransomware source code, which surfaced shortly after the invasion. We have identified and downloaded at least half a dozen data leaks provided by the nb65 group that accompanied the group’s announcement of the CONTI code use.

Figure 8: nb65 Announces Use of CONTI ransomware Against JSC Bank of Russia

Hackers Hacking Hackers

On 20 March, Arvin Club published a data leak associated with the pro-Russian aligned STORMOUS ransomware gang. Arvin claimed the group poorly configured their ‘new’ Tor service after mirroring their Telegram content to the anonymous network. It was unclear whether this was motivated by malice or geopolitical alliances.

In early March, STORMOUS posted an official statement to their Telegram channel stating they did not intend to attack Ukraine but could not sit back and watch attacks against the country [Russia] that “means so much to us.” They also included CONTI’s logo and the handshake emoji with their respective hashtags, symbolizing some level of partnership.

Figure 9: Arvin Club Leak of STORMOUS Info on Tor | STORMOUS World Announcement

In the last month, Russian ransomware groups and threat actors are actively targeting pro-Ukrainian cybersecurity researchers and Anonymous-linked cyber cells. Many researchers have been doxed and threatened across social media and Telegram in vendetta-like attacks.

2022 OnRamp Insurance Conference Recap

June 24, 2022

State of the Union: Cybersecurity Landscape is Shifting

Panel: Cybersecurity within Insurance

“Just like the FICO score set the industry standard on [the insurance market] and underwriting, we believe that the exposure score on the darknet is going to be a simple numeric number that quantifies a company’s exposure and therefore, risk.”

Ramesh Elaiyavalli on “Cybersecurity within Insurance” Panel

Final Takeaways

Interested in meeting with us at a future event? Check out where we will be this year and request time here.

Read more from Ramesh – From DarkOwl’s CTO: Deciphering Darknet Big Data

The new criminal gang specializes in leaked data and digital defacement

June 27, 2022

June 15, 2022

SiegedSec: A New Cyber Threat Actor Group

Defaced and Leaked Data

Intentions, Motivations, and Shenanigans

SiegedSec Members & Connections with Other “Hacker” Groups

Final Thought From Our Analysts

June 09, 2022

The recent buzz around Conti poses questions about what is really going on with the notorious ransomware group

Recent Victims

A Consequential Breach of Trust and Dox of the Team

Conti’s Public-Affiliation with STORMOUS Group

NB65 Weaponizes Conti Source Code Against Russia

“Epic failure of incident response…We decided to relieve you of you Sharepoint sites, Azure AD connections, and all of your user OUs. Credential reuse is awesome! Don’t blame Nikolai, he didn’t know. Teams might be struggling.”

Could Conti’s ceasefire be simply a by-product of on-going darknet drama between ransomware threat actors?

[Translation]

[Figure Translation]

“Maybe they’re just changing the infrastructure. Some researcher was monitoring one panel, it died, and he began to crack all over the world that Conti quit. The question is who is hyping here…”

DarkOwl will continue to monitor Conti and Conti-affiliated groups. Victim announcements can be pulled using our latest product Ransomware API. Contact us to learn more.

June 01, 2022

So Sarah, tell us about this product

What made you want to develop this endpoint?

Tell me more about these ransomware group sites

What would a company being mentioned on one of these sites mean?

Image A: Screen capture of a ransomware group posting on the darknet that describes the data obtained from one of their victims

Image B: Screen capture of the same ransomware posting as Image A, as indexed within DarkOwl’s database and seen in Vision UI

If the attack has already happened, why does it matter?

Who are the most prolific ransomware actors?

How does DarkOwl track these groups?

Is there a particular use case that you think Ransomware API is a good fit for?

How is this different from our other API products?

What else makes this product special?

Anything to look forward to from DarkOwl team? What is the product team excited about?

Where can people learn more?

View Ransomware API Product Page and Ransomware API Datasheet.

May 26, 2022

Darknet Background

Critical Credential Data

Key Compromise

Figure 1: Source DarkOwl Vision

Figure 2: Source DarkOwl Vision

Figure 3: Source DarkOwl Vision

Figure 4: Source DarkOwl Vision

Keys on Offer

Figure 5: Source DarkOwl Vision

Figure 6: Source DarkOwl Vision

Figure 7: Source DarkOwl Vision

Figure 8: Source DarkOwl Vision

Figure 9: Source DarkOwl Vision

Curious about something you read? Interested in learning more? Contact us to find out how darknet data applies to your use case.

May 19, 2022

Overview: Information Stealers (or ‘infostealers’)

Redline

Figure 1: Offer for Redline Stealer for sale on Darkfox Darknet Marketplace

Racoon

Figure 2: Raccoonstealer Representative Announcement of Shutdown due to Ukraine-Russia War

Vidar

Predator the Thief

Mars

Figure 3: Original post about the Mars Stealer whose Representative has since been banned

Blackguard

Figure 4: Forum post criticizing Blackguard stealer malware

[Figure Translated]

Figure 5: Forum post criticizing Blackguard’s lifetime subscription prices

[FIGURE TRANSLATED]

Jester

Figure 6: Eternity stealer promotional information provided by the threat actor

Taurus

Figure 7: Offer of source code for sale for Predator the Thief and Taurus stealer software

[Figure Translated]