Unencrypted Attachments Helped Investigators Unravel the Bayrob Cybercrime Network
· 1:36:36 · Watch on YouTube ↗
Summary
Darknet Diaries recounts how researchers and the FBI investigated Bayrob, using proxy infiltration, unencrypted attachments and phone forensics to connect operators to auction fraud and a botnet of roughly 400,000 systems.
Key points
- Bayrob intercepted victims' eBay browsing sessions and injected fraudulent auctions and fake support chats to solicit payments through money mules.
- Early fraud was restricted to selected American locations, complicating analysis by a researcher based in Ireland.
- Operators concealed their activity through infected-computer proxy chains, encrypted communications and stolen residential Wi-Fi accessed with directional antennas.
- A researcher infiltrated the proxy network by configuring an infected system to meet its bandwidth, location and apparent-user requirements.
- Occasionally unencrypted Jabber attachments exposed transaction spreadsheets, victim information, revenue shares and an operator's desktop despite encrypted chat messages.
- Investigators described roughly 400,000 infected systems supporting cryptocurrency mining, proxy sales, advertising fraud and theft of financial information.
- Phone forensics linked a suspect to Bayrob operations; three principal suspects were arrested and extradited, and Dette pleaded guilty and received a 10-year sentence.
Article Details
- Topics
- [02:18] Bayrob malware analysis and fraudulent eBay browsing sessions
- [03:49] Infection delivery, geographic restrictions and victim-assisted research
- [07:43] Operator taunts and infiltration of the infected-computer proxy network
- [15:33] FBI investigation and private-sector cooperation
- [29:16] A personal email slip and cross-border evidence collection
- [33:18] Botnet monetization and command-and-control interception
- [43:20] Unencrypted attachments revealing fraud operations
- [47:53] Phone forensics, arrests and attribution of operator identities
- [01:00:17] Stolen Wi-Fi and layered operational security
- [01:05:00] Guilty plea, forensic correlation and trial preparation
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gayasoleim[.]com | Identified in the transcript as a Bayrob command-and-control domain used to taunt the investigating researcher. |
| DOMAIN | lemthe[.]com | Listed in the transcript among Bayrob command-and-control domain names used to taunt the investigating researcher. |
MITRE ATT&CK
T1090.003 · Multi-hop ProxyOperators routed communications through multiple infected computers to conceal their origins.T1113 · Screen CaptureOperators took screenshots of infected computers to assess whether they appeared to belong to ordinary users before using them as proxies.T1496 · Resource HijackingInvestigators observed infected systems being instructed to join mining pools and mine cryptocurrency for the operators.T1557 · Adversary-in-the-MiddleBayrob intercepted victims' eBay connections and injected fraudulent auction information and support chats into browsing sessions.
People
Brian LavineDOJ cybercrime prosecutor who describes legal process, international cooperation, extradition and preparation of the Bayrob prosecution.Duncan BrownAssistant US attorney in the Northern District of Ohio who helped bring Brian Lavine into the Bayrob case.Lima MuruIntroduces himself as a malware analyst; the transcript subsequently calls him Liam. Describes analyzing Bayrob, infiltrating its proxy network and sharing evidence with investigators.Owen MillerAOL investigator who analyzed network traffic associated with Bayrob and identified a personal-email mistake that helped investigators identify a suspect.Ryan McFarlandFormer FBI cyber agent who describes investigating Bayrob infrastructure and using phone forensics and activity correlations to connect operators to the criminal network.Stacy WhitakerRetired FBI agent who describes opening the Bayrob investigation after verifying malware on an auction-fraud victim's computer and coordinating subsequent evidence collection.
Threat Actors
a mighty SAExplicitly identified in the transcript as an alias of Tiberio Dette, a Bayrob operator who pleaded guilty and cooperated with investigators.Bay Robb groupThe transcript identifies this group as operating the Bayrob malware network for auction fraud, cryptocurrency mining, proxy sales and theft of financial information.Bogdan NicollescuNamed in the transcript as one of three principal Bayrob operators arrested in Romania and extradited to the United States; explicitly identified as Master Fraud.Master FraudExplicitly identified as an alias of Bogdan Nicollescu and described by investigators as a leader of the Bayrob group.MinultaExplicitly identified as an alias of Radu Miklaus, a principal Bayrob operator arrested in Romania and extradited.Radu MiklausNamed as one of three principal Bayrob operators arrested and extradited; explicitly linked to the aliases Minulta and Radu SPR.Radu SPRExplicitly identified as an alias of Radu Miklaus; investigators describe a personal-email mistake involving this name as an identification lead.Tiberio DetteNamed as a principal Bayrob operator, explicitly linked to the alias a mighty SA. The transcript reports that he pleaded guilty, cooperated and received a 10-year prison sentence.