Darknet Data Offers a View of Russian-Language Hacking Activity and Voter-Record Listings
Summary
DarkOwl surveys Russian-language darknet activity, citing hacking tools, credential listings and voter-record offers. It notes that many voter records are public and says there is no evidence the seller is linked to Russian government hackers.
Key points
- DarkOwl says Russian-language sites and content make up a substantial share of its collected darknet and deep-web material.
- The article describes reported techniques used in past attacks, including phishing, SQL injection and wireless network sniffing.
- DarkOwl cites forum discussions about tools such as SQLMap and offers of voter-registration data from more than 30 U.S. states.
- The article says some voter records offered for sale were several years old and that much of the information was publicly available.
- A seller claimed to refresh voter data weekly, but the article provides no verification of that claim.
- DarkOwl says there is no indication that the voter-record seller is affiliated with Russian government-sponsored hackers.
Article Details
- Topic
- Russian-language darknet activity, cyber operations, and the sale of U.S. voter registration data
MITRE ATT&CK
T1040 · Network SniffingThe article reports wireless network sniffing to access World Anti-Doping Agency networks.T1190 · Exploit Public-Facing ApplicationThe article describes SQL injection used to breach U.S. Election Assistance Commission servers.T1566.001 · Spearphishing AttachmentThe article describes targeted spear-phishing emails with infected MS Word attachments sent to election officials.
Threat Actors
Malware
ChopstickThe hackers also used a mixture of malware including Gamefish, X-tunnel, and Chopstick code, the majority of which have been seen before and used on other Russian-linked cyberattacks.GamefishThe hackers also used a mixture of malware including Gamefish, X-tunnel, and Chopstick code, the majority of which have been seen before and used on other Russian-linked cyberattacks.X-TunnelThe hackers also used a mixture of malware including Gamefish, X-tunnel, and Chopstick code, the majority of which have been seen before and used on other Russian-linked cyberattacks.
Tools
AcunetixIn the voter registration system hack in 2016, threat actors utilized simple whitehat vulnerability tools such as Acunetix, network discovery and exploitation kits like DirBuster, SQLMap, and SQLSentinel.DirBusterIn the voter registration system hack in 2016, threat actors utilized simple whitehat vulnerability tools such as Acunetix, network discovery and exploitation kits like DirBuster, SQLMap, and SQLSentinel.sqlmapIn the voter registration system hack in 2016, threat actors utilized simple whitehat vulnerability tools such as Acunetix, network discovery and exploitation kits like DirBuster, SQLMap, and SQLSentinel.SQLSentinelIn the voter registration system hack in 2016, threat actors utilized simple whitehat vulnerability tools such as Acunetix, network discovery and exploitation kits like DirBuster, SQLMap, and SQLSentinel.