article thumbnail

Facebook, Instagram, TikTok and Twitter Target Resellers of Hacked Accounts

Krebs on Security

Facebook told KrebsOnSecurity it seized hundreds of accounts — mainly on Instagram — that have been stolen from legitimate users through a variety of intimidation and harassment tactics, including hacking, coercion, extortion, sextortion , SIM swapping , and swatting. THE MIDDLEMEN.

article thumbnail

Who’s Behind the Botnet-Based Service BHProxies?

Krebs on Security

The account didn’t resume posting on the forum until April 2014. Shotliff said he sold his BHProxies account to another Black Hat World forum user from Egypt back in 2014. He also shared a PayPal receipt and snippets of Facebook Messenger logs showing conversations in March 2014 with legendboy2050@yahoo.com. com on Mar.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Actions Target Russian Govt. Botnet, Hydra Dark Market

Krebs on Security

Security experts say both VPNFilter and Cyclops Blink are the work of a hacking group known as Sandworm or Voodoo Bear , the same Russian team blamed for disrupting Ukraine’s electricity in 2015. SANDWORM AND TRITON. energy facilities. and international companies and entities, including U.S. ” HYDRA. . ” HYDRA.

Marketing 255
article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

has been associated with the user Kerens on the Russian hacking forum Exploit from 2011 to the present day. Intel 471 found that Kerens used the email address pepyak@gmail.com , which also was used to register Kerens accounts on the Russian language hacking forums Verified and Damagelab. The WHOIS records for autodoska[.]biz

Malware 227
article thumbnail

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

Faceless grew out of a popular anonymity service called iSocks , which was launched in 2014 and advertised on multiple Russian crime forums as a proxy service that customers could use to route their malicious Web traffic through compromised computers. A new member of the Russian hacking forum Nohide[.]Space

Malware 243
article thumbnail

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

That same day, AWM Proxy — a 14-year-old anonymity service that rents hacked PCs to cybercriminals — suddenly went offline. Launched in March 2008, AWM Proxy quickly became the largest service for crooks seeking to route their malicious Web traffic through compromised devices.

Passwords 250
article thumbnail

Interview With a Crypto Scam Investment Spammer

Krebs on Security

pw has been registered and abandoned by several parties since 2014, but the most recent registration data available through DomainTools.com shows it was registered in March 2020 to someone in Krasnodar, Russia with the email address edgard011012@gmail.com. A DIRECT QUOT The domain quot[.]pw pw was their domain.

Scams 252