#hacking ring

Ukraine Takes $8.3M in Seized Crypto Under State Management in a First

Over 8.3 million USDT seized from an alleged hacking ring has been moved to a wallet held by Ukraine's asset-recovery agency, ARMA.

Kaveh Waddell, The Atlantic, Jun 9, 2016

A man with intense eyes crouches over a laptop in a darkened room, his face and hands hidden by a black ski mask and gloves. The scene is lit only by the computer screen’s eerie glow.

Exaggerated portraits of malicious hackers just like this keep popping up in movies and TV, despite the best efforts of shows like Mr. Robot to depict hackers in a more realistic way. Add a cacophony of news about data breaches that have shaken the U.S. government, taken entire hospital systems hostage, and defrauded the international banking system, and hackers start to sound like omnipotent super-villains.

But the reality is, as usual, less dramatic. While some of the largest cyberattacks have been the work of state-sponsored hackers--the OPM data breach that affected millions of Americans last year, for example, or the Sony hack that revealed Hollywood’s intimate secrets?--the vast majority of the world’s quotidian digital malice comes from garden-variety hackers.

And for many of those cybercriminals, hacking is as unglamorous as any other business. That’s what a group of security researchers found when they infiltrated a ring of hackers based in Russia earlier this year, and monitored its dealings over the course of five months.

The researchers were with Flashpoint, an American cybersecurity company that investigates threats on the dark and deep web. Their undercover operation began when they came across a post on a Russian hacker forum on the dark web--a part of the internet that’s inaccessible to regular browsers--that read very much like a get-rich-quick ad you might find on Facebook.

“Good day. This offer is for those who want to earn a lot of money via, shall we say, not a very righteous path,” the ad began, according to Flashpoint’s report. “No fees or advance payments from you are required, only a large and pure desire to make money in your free time.”

The post went on to say that candidates weren’t required to have any particular prior experience. “Even a schoolboy” could do the job, the ad says, and the low-risk work comes with potentially high rewards. The Flashpoint researchers assumed a fake identity and responded.

They got the job, and were admitted to a small cybercrime ring loosely organized around a single crime boss, who farmed out much of his grunt work to a group of 10-15 “affiliates.” The group specialized in ransomware, a type of virus that infects a computer or server and locks away its contents with strong encryption. The attacker then demands a ransom--any amount from several hundred to several thousands of dollars--in exchange for the keys that will free the encrypted files.

In the crime ring, the business relationship was clearly delineated: The boss programmed custom ransomware viruses, which he then distributed to his affiliates. It was the affiliates’ job to infect targets and demand the ransom. Once they deployed the malware, the easy part of the job falls to the boss. He communicates with victims, extracts ransoms via Bitcoin, and shares 40 percent of each payment with the affiliate.

To convince the boss of their fake identities as Russian hackers, the Flashpoint researchers played along with his demands. “He thought that we were actually committing crimes,” said Andrei Barysevich, the firm’s director of Eastern European research and analysis. “He thought that we were infecting random people’s computers, and that we received payments from them, when in reality it was us doing it all in house: We infected our own computers, we made our own payments.”

Posing as one of the kingpin’s 10 or 15 affiliates, the researchers found that they were afforded a surprising measure of independence. Affiliates were expected to find their own victims and set their own ransom demands. Some preferred to cast as wide a net as possible, using networks of compromised computers called botnets to infect many computers at once. Others preferred to chase high-value targets like rich individuals or critical services--think hospitals or government agencies--that might be willing to pay much higher ransoms to regain access to their systems.

Flashpoint found that the average payout from a successful ransom ask was about 300 dollars. But not every infection led to a payout: In a large-scale, opportunistic attack, between 5 and 10 percent of victims actually pay the ransom, Barysevich said. With 10 or 15 associates working to infect new victims, the crew was only able to extract an average of one ransom a day.

Nobody’s getting filthy rich with that sort of cash flow, but the ransomware boss certainly makes out well. The ringleader made about 7,500 dollars a month, Flashpoint estimated--about 17 times the average monthly salary in Russia. Even the boss’s affiliates, who get less than half of each ransom that they extract, make a decent wage. They earned an average of 600 dollars a month, or about 40 percent more than the average Russian worker.

That’s a pretty good salary for a position that doesn’t require sophisticated technical skills. Barysevich says most affiliates relied on other people for the tools they needed to infect computers, like buying already-established botnets. Cooperative models that free cybercriminals from having to actually program a virus has opened up the criminal-hacking field, allowing a much larger and more diverse group of people to enter.

New Post has been published on http://www.therakyatpost.com/world/2015/02/18/powerful-hacking-ring-exposed-russian-firm/

Powerful hacking ring exposed by Russian firm

MOSCOW, Feb 18, 2015:

Russian cyber-security firm Kaspersky Lab said Tuesday it has discovered a hacking ring behind sophisticated attacks on governments and companies in over 30 countries.

Kaspersky said the collective, dubbed “The Equation Group”, “surpasses anything known in complexity and sophistication” and has been active for nearly 20 years.

The hackers are “unique almost in every aspect of their activities” and single out victims with “surgical precision”, the company said in a statement.

Kaspersky said the group uses “classic spying techniques to deliver malicious payloads to the victims” among which is a first-known type of malware that is capable of infecting hard drives.

Some of the countries hardest hit by the hacking ring are Iran, Russia, Pakistan, Afghanistan, India, China, Syria and Mali.

Attacks target government institutions and strategic industries like energy, aerospace, nuclear and as well as Islamic activists, Kaspersky said.

Not bound to just the web, Equation also operates in the physical world, once targeting a US scientific conference by handing out CDs which carried a virus.

Though the identity of the hackers is unknown, Kaspersky has linked them to other groups, notably the authors of the Stuxnet and Flame viruses, with whom Equation interacted “from a position of superiority”.

Stuxnet is a computer worm discovered in 2010 that was used in attacks, which Tehran blamed on the United States, against networks associated with Iran’s nuclear programme.

“The Equation Group is probably one of the most sophisticated cyber attack groups in the world and they are the most advanced threat actor we have seen,” the report said.

Kaspersky revealed on Monday a wave of cyberattacks that have cost banks around the globe up to US$1 billion (870 million euros) since 2013.

A hacking ring has stolen up to $1 billion from banks around the world in what would be one of the biggest banking breaches known, a cybersecurity firm says in a report scheduled to be delivered Monday.