article thumbnail

A Deep Dive Into the Residential Proxy Service ‘911’

Krebs on Security

The 911 user interface, as it existed when the service first launched in 2016. net available at the Wayback Machine shows that in 2016 this domain was used for the “ ExE Bucks ” affiliate program, a pay-per-install business which catered to people already running large collections of hacked computers or compromised websites. .

VPN 304
article thumbnail

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

Flashpoint said MrMurza appears to be extensively involved in botnet activity and “drops” — fraudulent bank accounts created using stolen identity data that are often used in money laundering and cash-out schemes. was used for an account “Hackerok” at the accounting service klerk.ru

Malware 234
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Dirt-Cheap, Legit, Windows Software: Pick Two

Krebs on Security

Last week, KrebsOnSecurity heard from a reader who’d just purchased a copy of Microsoft Office 2016 Professional Plus from a seller on eBay for less than $4. Let’s call this Red Flag #1, as a legitimately purchased license of Microsoft Office 2016 is still going to cost between $70 and $100. Thank you for your purchase:).

Software 250
article thumbnail

This Service Helps Malware Authors Fix Flaws in their Code

Krebs on Security

” From 2013 to 2016, upO was a major player on Exploit[.]in For roughly one year beginning in 2016, Lebron was a top moderator on Exploit. For roughly one year beginning in 2016, Lebron was a top moderator on Exploit. in in late 2016, complaining that RedBear was refusing to pay a debt owed to him.

Malware 314
article thumbnail

How Phishers Are Slinking Their Links Into LinkedIn

Krebs on Security

The trouble is, there’s little to stop criminals from leveraging newly registered or hacked LinkedIn business accounts to create their own ad campaigns using Slinks. Way back in 2016, security firm Fortinet blogged about LinkedIn’s redirect being used to promote phishing sites and online pharmacies. Image: Urlscan.io.

Phishing 326
article thumbnail

Actions Target Russian Govt. Botnet, Hydra Dark Market

Krebs on Security

Sandworm also has been implicated in the “ Industroyer ” malware attacks on Ukraine’s power grid in December 2016, as well as the 2016 global malware contagion “ NotPetya, ” which crippled companies worldwide using an exploit believed to have been developed by and then stolen from the U.S. .

Marketing 247
article thumbnail

911 Proxy Service Implodes After Disclosing Breach

Krebs on Security

net circa 2016, which shows it was the homepage of a pay-per-install affiliate program that incentivized the silent installation of 911’s proxy software. ” According to 911, the service was hacked in early July, and it was discovered that someone manipulated the balances of a large number of user accounts.