article thumbnail

Who’s Behind the NetWire Remote Access Trojan?

Krebs on Security

A Croatian national has been arrested for allegedly operating NetWire , a Remote Access Trojan (RAT) marketed on cybercrime forums since 2012 as a stealthy way to spy on infected systems and siphon passwords. Constella also shows the email address zankomario@gmail.com used the password “dugidox2407.” ” Mr.

DNS 248
article thumbnail

$10M Is Yours If You Can Get This Guy to Leave Russia

Krebs on Security

law enforcement seized the cryptocurrency exchange BTC-e , and the Secret Service said those records show that a Denis Kulkov from Samara supplied the username “ Nordexin ,” email address nordexin@ya.ru, and an address in Samara. This and other “nordia@” emails shared a password: “ anna59.”

Marketing 235
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

2 Million User Records from Adult Streaming Website MyFreeCams.com Sold in Underground Forum

Hot for Security

The perp claims to have stolen usernames, emails, clear text passwords, and MFC Token balances of 2 million Premium and Diamond members. The threat actor made a pretty penny, based on his cryptocurrency wallet analysis that showed 49 Bitcoin transactions, equating to more than $22,000. Stop guessing what the internet knows about you.

article thumbnail

Is this Dead Hacker the Key to Twitter's Hack?

SecureWorld News

If you've heard any statements about Twitter over the last few days, they've probably included the words "hack," "verified users," "cryptocurrency," and potentially "Kanye West.". But, in 2010, Lamo made news: He'd been informing U.S. This story begins with a security researcher and a dead hacker. Only, not the way you're thinking.

Hacking 53
article thumbnail

Lazarus targets defense industry with ThreatNeedle

SecureList

We previously observed the Lazarus group utilizing this cluster when attacking cryptocurrency businesses and a mobile game company. It’s unknown how the attackers were able to obtain the credentials for that account, but it’s possible the credentials were saved in one of the infected system’s browser password managers.

Malware 132
article thumbnail

How Did Authorities Identify the Alleged Lockbit Boss?

Krebs on Security

used the password 225948. According to Constella, this email address was used in 2010 to register an account for a Dmitry Yurievich Khoroshev from Voronezh, Russia at the hosting provider firstvds.ru. Constella finds that the email addresses webmaster@stairwell.ru and admin@stairwell.ru DomainTools reports that stairwell.ru

article thumbnail

Who’s Behind the GandCrab Ransomware?

Krebs on Security

The following month, GandCrab bragged that the program in July 2018 netted almost 425,000 victims and extorted more than one million dollars worth of cryptocurrencies, much of which went to affiliates who helped to spread the infections. In 2010, the hottabych_k2 address was used to register the domain name dedserver[.]ru Vpn-service[.]us