article thumbnail

DDoS attacks in Q2 2021

SecureList

For example, April saw the active distribution of a new DDoS botnet called Simps — the name under which it introduced itself to owners of infected devices. The malware creators promoted their brainchild on a specially set-up YouTube channel and Discord server, where they discussed DDoS attacks.

DDOS 135
article thumbnail

Who is the Network Access Broker ‘Wazawaka?’

Krebs on Security

Wazawaka spent his early days on Exploit and other forums selling distributed denial-of-service (DDoS) attacks that could knock websites offline for about USD $80 a day. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.

DDOS 273
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Ten Years Later, New Clues in the Target Breach

Krebs on Security

The story on the Flashback author featured redacted screenshots that were taken from Ika’s BlackSEO account (see image above). The day after that story ran, Ika posted a farewell address to his mates, expressing shock and bewilderment over the apparent compromise of his BlackSEO account. ru under the handle “ r-fac1.”

article thumbnail

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Krebs on Security

For example, in 2010 Spamdot and its spam affiliate program Spamit were hacked, and its user database shows Sal and Icamis often accessed the forum from the same Internet address — usually from Cherepovets , an industrial town situated approximately 230 miles north of Moscow. bank accounts. ws was registered to an Andrew Artz.

article thumbnail

Top Zeus Botnet Suspect “Tank” Arrested in Geneva

Krebs on Security

Once inside a victim company’s bank accounts, the crooks would modify the firm’s payroll to add dozens of “ money mules ,” people recruited through work-at-home schemes to handle bank transfers. “In early October, the Ukrainian surveillance team said they’d lost him,” he wrote.

Banking 278
article thumbnail

How Did Authorities Identify the Alleged Lockbit Boss?

Krebs on Security

According to Constella, this email address was used in 2010 to register an account for a Dmitry Yurievich Khoroshev from Voronezh, Russia at the hosting provider firstvds.ru. “Installing SpyEYE, ZeuS, any DDoS and spam admin panels,” NeroWolfe wrote. DomainTools reports that stairwell.ru Image: Shutterstock.

article thumbnail

How $100M in Jobless Claims Went to Inmates

Krebs on Security

Many states also lacked the ability to tell when multiple payments were going to the same bank accounts. That’s a minor coup for a company launched in 2010 with the goal of helping e-commerce sites validate the identities of customers for the purposes of granting discounts for veterans, teachers, students, nurses and first responders.

Scams 315