Remove 2011 Remove Passwords Remove System Administration
article thumbnail

How Did Authorities Identify the Alleged Lockbit Boss?

Krebs on Security

used the password 225948. NEROWOLFE A search on the ICQ number 669316 at Intel 471 shows that in April 2011, a user by the name NeroWolfe joined the Russian cybercrime forum Zloy using the email address d.horoshev@gmail.com , and from an Internet address in Voronezh, RU. 2011 said he was a system administrator and C++ coder.

article thumbnail

Dissecting the malicious arsenal of the Makop ransomware gang

Security Affairs

Figure.NET flags (left) and obfuscation pattern (right) The tool is designed for two main purposes: generating comb lists of local windows user names and potential passwords, and testing them locally. The tool is able to automatically retrieve local users from groups, filter for administration, and then test the password.

article thumbnail

Updates from the MaaS: new threats delivered through NullMixer

Security Affairs

The Originating Malvertising Campaign According to CTI investigation on the adversary infrastructure, we were able to identify an ongoing campaign luring system administrators to install the malicious code into their machines. He is a former member of the ANeSeC CTF team, one of the firsts Italian cyber wargame teams born back in 2011.

Malware 98