article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

That same email address also is tied to two forum accounts for a user with the handle “ O.R.Z.” user account — this one on Verified[.]ru Prior to that, akafitis@gmail.com was used as the email address for the account “ Fitis ,” which was active on Exploit between September 2006 and May 2007.

Malware 227
article thumbnail

WeLeakInfo Leaked Customer Payment Info

Krebs on Security

In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card. Or the reverse — show me all the email accounts that ever used a specific password (see screenshot above). design was registered on Aug.

Passwords 277
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

Cyber intelligence firm Intel 471 reports that obelisk57@gmail.com was used to register an account on the forum Blacksoftware under the nickname “ Kerens.” In 2010, someone with the username Pepyak on the Russian language affiliate forum GoFuckBiz[.]com .” Crypt[.]guru’s biz and crypt[.]guru

Malware 207
article thumbnail

No SOCKS, No Shoes, No Malware Proxy Services!

Krebs on Security

com , a malware-based proxy network that has been in existence since at least 2010. Cached versions of the site show that in 2010 the software which powers the network was produced with a copyright of “ Escort Software.” The various “iboss” email accounts appear to have been shared by multiple parties.

Malware 240
article thumbnail

Canada Charges Its “Most Prolific Cybercriminal”

Krebs on Security

There is a now-dormant Myspace account for a Matthew Philbert from Orleans, a suburb of Ottawa, Ontario. The information tied to the Myspace account matches the age and town of the defendant. The Myspace account was registered under the nickname “ Darkcloudowner ,” and to the email address dark_cl0ud6@hotmail.com.

article thumbnail

$10M Is Yours If You Can Get This Guy to Leave Russia

Krebs on Security

” That handle used the same ICQ instant messenger account number ( 555724 ) as a Mazafaka denizen named “ Nordex.” ” In February 2005, Nordex posted to Mazafaka that he was in the market for hacked bank accounts, and offered 50 percent of the take. In 2017, U.S. Constella tracked another Bankir[.]com

Marketing 221
article thumbnail

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Krebs on Security

For example, in 2010 Spamdot and its spam affiliate program Spamit were hacked, and its user database shows Sal and Icamis often accessed the forum from the same Internet address — usually from Cherepovets , an industrial town situated approximately 230 miles north of Moscow. bank accounts. ws was registered to an Andrew Artz.