article thumbnail

15-Year-Old Malware Proxy Network VIP72 Goes Dark

Krebs on Security

based Internet address for more than a decade — simply vanished. Using services like VIP72, customers can select network nodes in virtually any country, and relay their traffic while hiding behind some unwitting victim’s Internet address. The domain Vip72[.]org “ Haxdoor ,” and “ Nuclear Grabber.”

Malware 296
article thumbnail

$10M Is Yours If You Can Get This Guy to Leave Russia

Krebs on Security

Launched in 2005, Try2Check soon was processing more than a million card-checking transactions per month — charging 20 cents per transaction. ” In February 2005, Nordex posted to Mazafaka that he was in the market for hacked bank accounts, and offered 50 percent of the take. Denis Kulkov, a.k.a. Image: USDOJ.

Marketing 244
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

In a typical PPI network, clients will submit their malware—a spambot or password-stealing Trojan, for example —to the service, which in turn charges per thousand successful installations, with the price depending on the requested geographic location of the desired victims. But on Dec. ru and alphadisplay[.]ru, Ukraincki over the years.

Passwords 251
article thumbnail

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. SocksEscort[.]com com , is what’s known as a “SOCKS Proxy” service.

Malware 211
article thumbnail

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Krebs on Security

From January 2005 to April 2013, there were two primary administrators of the cybercrime forum Spamdot (a.k.a Collectively in control over millions of spam-spewing zombies, those botmasters also continuously harvested passwords and other data from infected machines. And there were many good reasons to support this conclusion.

article thumbnail

G Suite users’ passwords stored in plain-text for more than 14 years

Security Affairs

Google accidentally stored the passwords of its G Suite users in plain-text for 14 years allowing its employees to access them. The news is disconcerting, Google has accidentally stored the passwords of the G Suite users in plain-text for 14 years, this means that every employee in the company was able to access them.

article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

Megatraffer explained that malware purveyors need a certificate because many antivirus products will be far more interested in unsigned software, and because signed files downloaded from the Internet don’t tend to get blocked by security features built into modern web browsers. “Why do I need a certificate? .” ru in 2008.

Malware 251