Darknet Markets Advertise Malware, Stolen Data and Other Tools for Cyber Operations
Summary
DarkOwl describes malware, credentials, personal data and other tools advertised on darknet markets, noting their potential use in cyber operations. The article also points to exposed SolarWinds credentials and earlier targeting claims.
Key points
- The article lists advertised tools including remote access trojans, bots, banking malware, ransomware and mobile forensic or authentication-bypass tools.
- It describes listings for stolen or exposed data, including credentials, personal information, business directories and government-related records; the claims are attributed to sellers.
- DarkOwl says its darknet monitoring found discussions and potential indicators involving SolarWinds, including credentials reportedly exposed in a public GitHub repository since 2018.
- The article links exposed credentials to organizational risk and cites reporting that FireEye's initial compromise involved employee VPN credentials.
- It presents the possible use of these goods in espionage, phishing, ransomware and disinformation as potential applications, not confirmed operations.
Article Details
- Topic
- Cyber weapons and other offensive capabilities advertised on darknet marketplaces and forums
People
Malware
Anubis BotThe Anubis Bot, Azorult 3.3 AZORult Trojan (Version 3.3), and Spy MAX v1.0 – Android RAT are all currently available for sale across many darknet marketplaces and accessible via instant download link delivered uponAzoRultThe Anubis Bot, Azorult 3.3 AZORult Trojan (Version 3.3), and Spy MAX v1.0 – Android RAT are all currently available for sale across many darknet marketplaces and accessible via instant download link delivered uponGonnaCryWannaCry (aka GonnaCry) ransomware successfully crippled the UK’s National Health System and is currently for sale on White House Market for $150 USD.GozNymVendor leaguemode on DarkMarket offers the GozNym 2.0 banking bot for purchase for $1500 USD per build.KingLockerThe source code for another effective ransomware, known as KingLocker, is also available for purchase and could be customized by a nation state to conduct a large scale campaign against a target industry or country.Pegasuswhen the Kingdom of Saudi Arabia’s (KSA) intelligence and government officials were caught using the Pegasus malware against WhatsApp and iPhone messaging platforms, developed by an Israeli security firm, to targetSpy MAXThe Anubis Bot, Azorult 3.3 AZORult Trojan (Version 3.3), and Spy MAX v1.0 – Android RAT are all currently available for sale across many darknet marketplaces and accessible via instant download link delivered uponWannaCryWannaCry (aka GonnaCry) ransomware successfully crippled the UK’s National Health System and is currently for sale on White House Market for $150 USD.
Products
iPhone(KSA) intelligence and government officials were caught using the Pegasus malware against WhatsApp and iPhone messaging platforms, developed by an Israeli security firm, to target dissident journalists.SolarWinds[Quick Read: Darknet posts show SolarWinds has been a target, and has open servers that trace back to Russia]VMwareThe approach, the NSA said, may have been used in an attack on VMware Inc.WhatsAppSaudi Arabia’s (KSA) intelligence and government officials were caught using the Pegasus malware against WhatsApp and iPhone messaging platforms, developed by an Israeli security firm, to target dissident journalists.
Tools
Cobalt StrikeCobalt Strike is a popular software emulation environment designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors and readily for sale on the darknet.KONBOOTThis package is advertised to include KONBOOT authentication bypass, Oxygen Forensics which retrieves deleted texts and extracts data from all the popular mobile-phone cloud providers.Magnet IEFsame type of tools, in packages such as KeyLogger Script Collections and CIA forensics expert tool – Magnet IEF on White House Market, or the FBI Hacking and Forensic Toolkit for exploiting mobile phones for sale byOxygen ForensicsThis package is advertised to include KONBOOT authentication bypass, Oxygen Forensics which retrieves deleted texts and extracts data from all the popular mobile-phone cloud providers.
Countries
CanadaTools to support the targeted phishing of international banks based in North America, such as CHASE and CIBC of Canada is also currently available for sale on darknet markets.North KoreaSome nation states, such as North Korea have been known to leverage banking malware for cyber-operations to recoup financial gain from the economic impact of international sanctions.Russia[Quick Read: Darknet posts show SolarWinds has been a target, and has open servers that trace back to Russia]Saudi ArabiaThis was publicly revealed when the Kingdom of Saudi Arabia’s (KSA) intelligence and government officials were caught using the Pegasus malware against WhatsApp and iPhone messaging platforms, developed by an IsraeliTaiwanAnother vendor offers Taiwan’s Ministry of Civil Service database of employees which could be used for targeted phishing to infect government networks for espionage for €69 EUR.