Threat Actor 0056113 Advertises Compromised Law-Enforcement Accounts and Fraudulent Data-Request Services
Summary
Threat actor 0056113 is reportedly selling law-enforcement and government email accounts, forged legal documents, and a service for submitting fraudulent Emergency Data Requests that could expose user data.
Key points
- The marketplace listing advertises working law-enforcement and government email accounts from ten countries for $20–$100 each.
- It offers forged court orders, MLATs, and subpoenas for about $100.
- An advertised service submits fraudulent Emergency Data Requests to major platforms, starting at $200; domain-suspension fraud is listed at $300.
- The listing claims such requests can obtain IP logs, device information, email-to-phone linkages, and sometimes message logs.
- The article says fraudulent requests can enable doxing, stalking, swatting, and sextortion; the reported listing does not independently establish that specific requests succeeded.
Article Details
- Event Type
- A cybercrime marketplace listing offers compromised law-enforcement and government email accounts, forged legal documents, and EDR-as-a-Service for fraudulent Emergency Data Requests.
- Impact
- The listing claims buyers can obtain IP logs, device information, email-to-phone linkages, and sometimes message logs from major platforms. The article says fraudulent requests can facilitate doxing, stalking, swatting, and sextortion, and have been tied to real-world harm and deaths.