Krebs on Security

APRIL 10, 2025

But experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime infrastructure and support staff. Until recently, the so-called “ Smishing Triad ” mainly impersonated toll road operators and shipping companies. Image: Prodaft.

Phishing 216

Phishing Banking Mobile Retail 216

Krebs on Security

APRIL 30, 2020

In a report published today, the company said since late March 2020 it has observed several crooks complaining about COVID-19 interfering with the daily activities of their various money mules (people hired to help launder the proceeds of cybercrime). ” Alex Holden , founder and CTO of Hold Security , agreed.

Cybercrime 349

Cybercrime Computers and Electronics Marketing Scams 349

Krebs on Security

AUGUST 9, 2021

Also, this greenhorn criminal clearly had bought into BriansClub’s advertising, which uses my name and likeness in a series of ads that run on all the top cybercrime forums. com was hosted at a company in Moscow with just a handful of other domains phishing popular cybercrime stores, including Jstashbazar[.]com, com, vclub[.]cards,

Phishing 362

Phishing Cybercrime Accountability Advertising 362

Krebs on Security

DECEMBER 13, 2022

Federal Bureau of Investigation (FBI) to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime forum. Pompompurin has been a thorn in the side of the FBI for years.

Hacking 363

Hacking Energy and Utilities Cybercrime Accountability 363

Krebs on Security

MAY 18, 2020

is cybercrime forum. “We can examine your (or not exactly your) PHP code for vulnerabilities and backdoors,” reads his offering on several prominent Russian cybercrime forums. The cybercrime actor “upO” on Exploit[.]in RedBear’s profile on the Russian-language xss[.]is

Malware 352

Malware Cybercrime Ransomware Marketing 352

Krebs on Security

OCTOBER 15, 2022

AMLBot , a service that helps businesses avoid transacting with cryptocurrency wallets that have been sanctioned for cybercrime activity, said an investigation published by KrebsOnSecurity last year helped it shut down three dark web services that secretly resold its technology to help cybercrooks avoid detection by anti-money laundering systems.

Cryptocurrency 296

Cryptocurrency Marketing Cybercrime Technology 296

Krebs on Security

JANUARY 17, 2024

The rapper and social media personality Punchmade Dev is perhaps best known for his flashy videos singing the praises of a cybercrime lifestyle. But until recently, there wasn’t much to support a conclusion that Punchmade was actually doing the cybercrime things he promotes in his songs. Punchmade Dev’s shop.

Cybercrime 325

Cybercrime Media Banking Accountability 325

Krebs on Security

OCTOBER 8, 2020

But judging from the proliferation of help-wanted ads for offensive pentesters in the cybercrime underground, today’s attackers have exactly zero trouble gaining that initial intrusion: The real challenge seems to be hiring enough people to help everyone profit from the access already gained. THE DOCTOR IS IN.

Cybercrime 352

Cybercrime Malware VPN Ransomware 352

Krebs on Security

AUGUST 16, 2022

Earlier this month, the administrator of the cybercrime forum Breached received a cease-and-desist letter from a cybersecurity firm. Such responses generally accomplish nothing, except unnecessarily upping the stakes for everyone involved while displaying a dangerous naiveté about how the cybercrime underground works.

Data breaches 323

Data breaches Banking Cybercrime Marketing 323

Krebs on Security

JANUARY 30, 2024

Indeed, those messages show Sosa/King Bob was obsessed with finding new “ grails ,” the slang term used in some cybercrime discussion channels to describe recordings from popular artists that have never been officially released. “I got the most music in the com,” King Bob bragged in a Discord server in November 2022.

Social Engineering 357

Social Engineering Mobile Passwords Cybercrime 357

Krebs on Security

AUGUST 2, 2022

The underground cybercrime forums are now awash in pleas from people who are desperately seeking a new supplier of abundant, cheap, and reliably clean proxies to restart their businesses. Last week, a seven-year-old proxy service called 911[.]re “Everybody is looking for an alternative, bro,” wrote a BlackHatForums user on Aug.

Malware 319

Malware Cybercrime Internet Internet 319

Krebs on Security

JULY 29, 2022

These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source.

Cybercrime 321

Cybercrime Software VPN Backups 321

Krebs on Security

APRIL 28, 2020

The request for the last four of the customer’s credit card number was consistent with my own testing, which relied upon on a caller ID spoofing service advertised in the cybercrime underground and aimed at a Citi account controlled by this author. A screen shot from an underground store selling CVV records. Click to enlarge.

Scams 363

Scams Banking Accountability Financial Services 363

Krebs on Security

SEPTEMBER 26, 2024

The United States today unveiled sanctions and indictments against the alleged proprietor of Joker’s Stash , a now-defunct cybercrime store that peddled tens of millions of payment cards stolen in some of the largest data breaches of the past decade. The answer involved Bitcoin, but also Taleon’s new service.

Cryptocurrency 297

Cryptocurrency Cybercrime Retail Government 297

Krebs on Security

NOVEMBER 6, 2023

Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. As detailed in this Nov. 2 story , SWAT currently employs more than 1,200 U.S.

Passwords 301

Passwords Cybercrime Accountability Hacking 301

Krebs on Security

SEPTEMBER 30, 2022

Interestingly, Maryann’s LinkedIn profile was accepted as truth by Cybercrime Magazine’s CISO 500 listing, which claims to maintain a list of the current CISOs at America’s largest companies: The fake CISO for ExxOnMobil was indexed in Cybercrime Magazine’s CISO 500.

CISO 345

CISO Cybercrime Accountability Information Security 345

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. And all of them operate via Telegram , a cloud-based instant messaging system.

Passwords 347

Passwords Mobile Authentication Banking 347

Krebs on Security

FEBRUARY 8, 2021

Brad Marden , superintendent of cybercrime operations for the Australian Federal Police (AFP), said their investigation into who was behind U-Admin began in late 2018, after Australian citizens began getting deluged with phishing attacks via mobile text messages that leveraged the software.

Phishing 332

Phishing Scams Banking Mobile 332

Krebs on Security

APRIL 18, 2023

” MRMURZA Faceless is a project from MrMurza , a particularly talkative member of more than a dozen Russian-language cybercrime forums over the past decade. MrMurza’s Faceless advertised on the Russian-language cybercrime forum ProCrd. Image: Darkbeast/Ke-la.com. In 2013, U.S.

Malware 296

Malware Passwords Accountability Advertising 296

Krebs on Security

NOVEMBER 16, 2022

A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode , an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic.

Malware 333

Malware Banking Phishing DDOS 333

Krebs on Security

DECEMBER 5, 2022

The defendants, who initially pursued a strategy of counter suing Google for interfering in their sprawling cybercrime business, later brazenly offered to dismantle the botnet in exchange for payment from Google. The judge in the case was not amused, found for the plaintiff, and ordered the defendants and their U.S.

Cybercrime 298

Cybercrime Malware Internet Internet 298

Krebs on Security

JULY 18, 2022

These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source. FORUM ACTIVITY?

VPN 352

VPN Computers and Electronics Antivirus Software 352

Krebs on Security

JULY 25, 2023

Proxy services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they make it difficult to trace malicious traffic to its original source. SocksEscort began in 2009 as “ super-socks[.]com com , segate[.]org

Malware 238

Malware VPN Internet Internet 238

Krebs on Security

AUGUST 23, 2024

But Caturegli said ransomware gangs and other cybercrime groups could siphon huge volumes of Microsoft Windows credentials from quite a few companies with just a small up-front investment. ” If we ever learn that cybercrime groups are using namespace collisions to launch ransomware attacks, nobody can say they weren’t warned. .

DNS 326

DNS Internet Internet Authentication 326

Krebs on Security

JANUARY 25, 2023

The tip about the Experian weakness came from Jenya Kushnir , a security researcher living in Ukraine who said he discovered the method being used by identity thieves after spending time on Telegram chat channels dedicated to cybercrime.

Cybercrime 341

Cybercrime Web Fraud Data breaches 341

Krebs on Security

SEPTEMBER 2, 2024

Picari was the owner, developer and main beneficiary of the service, and his personal information and ownership of OTP Agency was revealed in February 2020 in a “dox” posted to the now-defunct English-language cybercrime forum Raidforums. The NCA said it began investigating the service in June 2020.

Accountability 300

Accountability Banking Passwords Scams 300

Krebs on Security

MAY 23, 2020

Earlier this week, email security firm Agari detailed a fraud operation tied to a seasoned Nigerian cybercrime group it dubbed “ Scattered Canary ,” which has been busy of late bilking states and the federal government out of economic stimulus and unemployment payments. ” CANARY IN THE GOLDMINE.

Insurance 358

Insurance Accountability Banking Government 358

Krebs on Security

APRIL 3, 2024

Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called “ The Manipulaters ,” a sprawling web hosting network of phishing and spam delivery platforms.

Phishing 283

Phishing Cybercrime Malware Advertising 283

Krebs on Security

NOVEMBER 13, 2021

The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation.

Internet 363

Internet Internet Hacking Accountability 363

Krebs on Security

NOVEMBER 13, 2018

.” The report tracks the work of Magecart — the name given to a collective of at least seven cybercrime groups involved in hacking Web sites to steal payment card data. Credit card data stolen by these various Magecart groups invariably gets put up for sale at online cybercrime shops, the security firms found.

Accountability 246

Accountability eCommerce Cybercrime Advertising 246

Krebs on Security

JULY 29, 2021

“If you were to look [on cybercrime forums] at the past history of people posting about that Ledger database, you’d see people were selling it privately for months prior to that,” Nixon said.

Passwords 363

Passwords Password Management Phishing Scams 363

Krebs on Security

SEPTEMBER 18, 2024

These so-called “stealer logs” are mostly generated by opportunistic infections from information-stealing trojans that are sold on cybercrime markets.

Scams 65

Scams DNS Internet Internet 65

Krebs on Security

DECEMBER 8, 2022

.” While CLOP as a money making collective is a fairly young organization, security experts say CLOP members hail from a group of Threat Actors (TA) known as “TA505,” which MITRE’s ATT&CK database says is a financially motivated cybercrime group that has been active since at least 2014.

Healthcare 326

Healthcare Backups Ransomware Insurance 326

Krebs on Security

OCTOBER 31, 2023

A broad array of industry groups have filed comments opposing the proposed changes , saying they threaten to remove the last vestiges of accountability for a top-level domain that is already overrun with cybercrime activity. “This exposes how persistent the criminal economy can be at a supply chain level,” Burton said.

Phishing 331

Phishing Telecommunications Malware Scams 331

Krebs on Security

APRIL 4, 2024

In keeping with the overall theme, these phishing domains appear focused on stealing usernames and passwords to some of the cybercrime underground’s busiest shops, including Brian’s Club. Among those is rustraitor[.]info An archive.org copy of Rustraitor. What do all the phished sites have in common? com , meternask[.]com

Phishing 276

Phishing Cryptocurrency DDOS Internet 276

Krebs on Security

APRIL 12, 2022

Department of Justice (DOJ) said today it seized the website and user database for RaidForums , an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015.

Government 260

Government Identity Theft Mobile Data breaches 260

Krebs on Security

FEBRUARY 4, 2021

Like most cybercrime forums, OGUsers is overrun with shady characters who are there mainly to rip off other members. THE MIDDLEMEN. Facebook said it targeted a number of accounts tied to key sellers on OGUsers, as well as those who advertise the ability to broker stolen account sales.

Accountability 332

Accountability Hacking Media Mobile 332