Have you ever heard of King Servers? Most likely. Have you heard of SecretsLine? Maybe not. Again not a good combo. King Servers is a hosting company, providing dedicated servers, VPS in the USA, NL, and Russia. A person of interest going by the handle "King Servers," and uses the email address ivan@king-servers[.]com is part …
Continue reading King Servers, “DIe$el” and the Ransomware and Exploit kits business
In our quest to track criminals and expose their misconduct, we regularly monitor the threat actor that goes by the name APT28, Fancy Bear, STRONTIUM, Pawn Storm, Sednit. Granted some of these names are toolsets used by the criminals a name for a group. If tomorrow, they'd come to use different toolsets these names would have …
Yes, it is. The voice over IP scam is also called vishing for VoIP phishing. The fraudsters set up a fake call center using VoIP. They have different ways of implementing the calls. Some have already infected the victim's machine and collected a set of information on their victims. One victim mentioned on a forum …
Today, we wanted to discuss a Ukrainian provider called ITL Network. ITL Network is connected to another Ukrainian provider called Xserver as its upstream provider in the BPG routing. The graph below represents the BGP routing of Xserver (AS48031), where we can find the upstream link to ITL (AS15626). The threat recon team stumbled several times on …
Another phishing kit has emerged recently from the same actor "traderpcp" who seems to be very specialized into offering web shells, phishing kits, spam lists (also called leads), hacking tools, and cpanel access. The threat actor "traderpcp" is very active on a criminal marketplace where he sells his wares. We discovered a new phishing kit on a compromised …
Kiwibank users may be at risk as email phishing scam are leveraged by criminals to harvest Kiwibank users' credentials. The victims will be redirected to a malicious phishing website controlled by the criminals once they click on the link in the phishing emails received. Below is a copy of what the site looks like: Here is …
Continue reading Kiwibank users targeted by email phishing scam
A bank account brute forcing tool is a small program that is used by criminals to verify bank accounts credentials validity against the bank website. All it needs is a list of credentials in the following format - username:password. We found one of this program, called CapitalOne Brute created by Strannik. This program is meant …
Continue reading Bank account brute forcing tool by Strannik
We observed a series of domains luring people to download a flash update or a Clash of Clans game trick for mobile phones running the Android platform. We downloaded the same malicious apk file from both websites. The file name is flash_update.apk and SHA1 is dc42fcd427054227a6ee2dd92b8356e57f9ead77. The malicious application requires the following permissions: android.permission.CHANGE_NETWORK_STATE (change …
Continue reading Android Marcher posing as Flash update and Clash of Clans game trick
Threat Intel Recon 