article thumbnail

Bulletproof VPN services took down in a global police operation

Security Affairs

A joint operation conducted by law European enforcement agencies resulted in the seizure of the infrastructure of three bulletproof VPN services. ” The three VPN bulletproof services were hosted at insorg.org , safe-inet.com , and safe-inet.net, their home page currently displays a law enforcement banner. day to $190/year.

VPN 113
article thumbnail

Who’s Behind the GandCrab Ransomware?

Krebs on Security

Russian security firm Kaspersky Lab estimated that by the time the program ceased operations, GandCrab accounted for up to half of the global ransomware market. In 2010, the hottabych_k2 address was used to register the domain name dedserver[.]ru At least four posts made in 2010 to the hosting review service makeserver.ru

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Who is the Network Access Broker ‘Wazawaka?’

Krebs on Security

More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.

DDOS 272
article thumbnail

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

Riley Kilmer is co-founder of Spur.us , a company that tracks thousands of VPN and proxy networks, and helps customers identify traffic coming through these anonymity services. MrMurza also told the admin that his account number at the now-defunct virtual currency Liberty Reserve was U1018928. Image: spur.us.

Malware 243
article thumbnail

Who Is the Network Access Broker ‘Babam’?

Krebs on Security

Since the beginning of 2020, Babam has set up numerous auctions on the Russian-language cybercrime forum Exploit , mainly selling virtual private networking (VPN) credentials stolen from various companies. The username associated with that account was “ bo3dom.” com back in 2011, and sanjulianhotels[.]com com (2017).

article thumbnail

Key aerospace player Safran Group leaks sensitive data

Security Affairs

Knowing them, a threat actor could be able to hijack the session and therefore the account. If attackers had access to this key, they could create an admin account and have privileged access to a website. The unidentified hackers allegedly attempted to map the company’s computer system between 2009 and 2010.

article thumbnail

Scammers, profiteers, and shady sites? It must be tax season

Malwarebytes

Most of the tax-related attacks follow a few tried and true methods: A phishing email or scam call from someone purporting to be from the IRS, or an accountant offering to help you get a big refund. The first snapshot promoting an online tax filing service shows up in 2010. They want your hard-earned dollars in their pockets.