[comment]:<> (===START_PAGE 1===) {0}------------------------------------------------ ![Telegram logo icon](935eed7aa61f7777f62cfc032e11bee9_img.jpg) The Telegram logo, a white paper plane icon inside a blue circle. Telegram logo icon # TELEGRAM **How a Messenger Turned Into a Cybercrime Ecosystem by 2023** {1}------------------------------------------------ ## Executive Summary Telegram is a messaging app that is used by many people around the world for a variety of purposes.However, it has also become a hub for cybercrime activities, including the sale and leakage of stolen personal and corporate data, the organization of cybercrime gangs, the distribution of hacking tutorials, hacktivism and the sale of illegal physical products such as counterfeits and drugs. There are several other messaging apps that are favored by cybercriminals, but Telegram is one of the most popular.This presents a significant challenge for security researchers trying to combat cybercrime on the platform. One reason why Telegram is attractive to cybercriminals is its alleged built-in encryption and the ability to create channels and large, private groups.These features make it difficult for law enforcement and security researchers to monitor and track criminal activity on the platform.In addition, cybercriminals often use coded language and alternative spellings to communicate on Telegram, making it even more challenging to decipher their conversations. This report, compiled by KELA, aims to provide an in-depth understanding of why Telegram has become a significant player in the cybercrime ecosystem.It covers various services, products and cybercrime activities that exist on the platform, as well as the threat actors involved.The report also includes showcases for each topic, highlighting specific examples of the types of activities that take place on Telegram.In addition, the report lists prominent groups and channels that are involved in these activities, providing a comprehensive overview of the scope and scale of cybercrime on the platform. ### The following topics and actors are discussed in this report: - Personal and corporate data being sold and leaked on Telegram - Info-stealing hacking teams that use Telegram to sell and leak data harvested through infostealers, and to organize gangs and build bots to facilitate their activities - Banking fraud actors that use Telegram to easily sell credit cards, checks and other financial instruments - Ransomware and data extortion groups that adopt Telegram as an alternative or addition to their blogs and data leak sites, such as Lapsus\$ - Hacktivists who use Telegram to publicize information about their attacks, such as Killnet and ALTahrea Team - Illegal physical products being sold via Telegram, including counterfeits, guns, drugs and COVID-19 documents While KELA chose to focus on items specific to each topic, it's important to remember that more information on each subject can be found on the platform, such as tutorials, services, etc. Overall, Telegram has become a thriving ecosystem for cybercrime and will likely continue to be a major challenge for security researchers and law enforcement. {2}------------------------------------------------ ## Table of Contents ## ● Section 1 | Overview - What is Telegram - How is Telegram Built - Why Telegram is Good for Cybercrime - Cybercriminals' Language on Telegram - Other Messengers Favored by Cybercriminals - Challenges for Security Researches ## ● Section 2 | Types of Crimes - Personal and Corporate Data - Infostealers - Ransomware and Data Extortion Groups - Hacktivism - Illegal Physical Products ## ● Section 3 | Recommendations for cybercrime researchers ## ● Section 4 | Appendix 1 - Case Studies {3}------------------------------------------------ ## Section **#1** Overview --- {4}------------------------------------------------ ### What is Telegram? Telegram is a multi-platform messaging service launched by the Russian brothers Nikolai and Pavel Durov in 2013.They are also known to be founders of VK (formerly known as Vkontakte), a Russian online social media and social networking service.According to Telegram’s privacy policy, Telegram Group Inc.is a parent company of Telegram Messenger Inc.and is located in the British Virgin Islands, and Telegram FZ-LLC is a group member located in Dubai.¹ Telegram mentions that the Telegram development team is based in Dubai.² Telegram allows users to send messages, photos, videos and files of any type (doc, zip, mp3, etc.) up to 2GB in size, and to create groups and channels.The company claims that Telegram is unique because of its focus on privacy, encryption and an open-source API.It provides optional end-to-end encrypted chats, and sent messages can be deleted at any time on both sides.In addition, with the publicly available API, developers can create clients on other platforms, custom bots, themes, stickers and so on free of charge.³ However, there are some downsides to using Telegram.First, although Telegram offers APIs, the company doesn’t disclose the code of the application itself.Therefore, there’s no way to know if the encryption is truly secure.Second, Telegram has been known to cooperate with law enforcement in some cases, which means that messages are not as private as one might think.⁴ As shown in the following chart, the number of monthly active Telegram users worldwide has increased, and it had over 700 million monthly active users as of November 2022.⁵ ![A 3D bar chart showing the growth of monthly active Telegram users from March 2014 to November 2022.The y-axis represents the number of users in millions, ranging from 0 to 800.The x-axis shows specific dates and user counts:35 (Mar '14), 50 (Dec '14), 60 (Sep '15), 100 (Feb '16), 180 (Dec '17), 200 (Mar '18), 400 (Apr '20), 500 (Apr '22), and 700 (Nov '22).The bars are colored red, black, teal, grey, red, black, teal, grey, and red respectively.](6f1efa91fb9b476380af7a35db4f14bf_img.jpg) | Date | Monthly Active Users (millions) | |---------|---------------------------------| | Mar '14 | 35 | | Dec '14 | 50 | | Sep '15 | 60 | | Feb '16 | 100 | | Dec '17 | 180 | | Mar '18 | 200 | | Apr '20 | 400 | | Apr '22 | 500 | | Nov '22 | 700 | A 3D bar chart showing the growth of monthly active Telegram users from March 2014 to November 2022.The y-axis represents the number of users in millions, ranging from 0 to 800.The x-axis shows specific dates and user counts:35 (Mar '14), 50 (Dec '14), 60 (Sep '15), 100 (Feb '16), 180 (Dec '17), 200 (Mar '18), 400 (Apr '20), 500 (Apr '22), and 700 (Nov '22).The bars are colored red, black, teal, grey, red, black, teal, grey, and red respectively. Figure:The number of monthly active Telegram users worldwide from March 2014 to November 2022 (in millions) ¹ Telegram Privacy Policy ² Telegram FAQ — Where is Telegram based? ³ Telegram offers Telegram Premium, an optional subscription service that unlocks additional exclusive features.For example, all Telegram users can upload files up to 2GB; however, **Premium users** are allowed up to 4GB. ⁴ Telegram Reportedly Handed User Data to German Authorities ⁵ Telegram FAQ — What is Telegram? What do I do here? {5}------------------------------------------------ ### How Telegram is Built Telegram users have two key identifiers:“usernames” and “user IDs.” Usernames are publicly facing and can be edited in the settings.Once Telegram users set their usernames, they can share their contact with others with a link, as a t.me/username or a username.t.me link (for example, the username of Pavel Durov, Telegram’s CEO, is t.me/durov).User IDs, on the other hand, are assigned to users, groups and channels by Telegram, and users aren’t able to change them. Telegram has several features that allow users not only to use it as a messaging service but also to build a community on the platform.One of them is “channels” that Telegram users can create for broadcasting to unlimited audiences.Channels are one-way communication platforms on which only admins send messages, and channel subscribers can’t reply.However, in 2020, Telegram updated the platform, allowing channel subscribers to comment under channel posts.⁶ To let channel subscribers comment, a channel admin user creates a chat.The chat can be hidden from followers; however, the admin can also share it with channel subscribers who can join the chat and use it to comment on specific posts and communicate with others. Another feature is “groups”:chat groups where members can interact with each other and reply to messages, and members can see their contacts in the same group.There are open ![A screenshot of a Telegram group chat named 'Kayla's Band' with 2,333 subscribers.The chat shows a message asking 'What should I name the album? Tell me in the comments!' with a '5 Comments' count highlighted by a red box.Below the image is the caption 'Image:Channel comments' with a small superscript 7.](35afbfc3c4a5c0fe01e91ba536605e09_img.jpg) A screenshot of a Telegram group chat named 'Kayla's Band' with 2,333 subscribers.The chat shows a message asking 'What should I name the album? Tell me in the comments!' with a '5 Comments' count highlighted by a red box.Below the image is the caption 'Image:Channel comments' with a small superscript 7. groups, and there are closed groups that can be accessed only by invitation.Users can add up to 200,000 people to one group.WhatsApp, a rival instant messaging platform, also allows users to create chat groups, but only up to 512 people can be added to a group.⁸ A group conversation on Instagram can add even less – up to 250 participants.⁹ Therefore, compared with other platforms, Telegram allows many more people to build a community. It’s also possible to use and create bots, which are essentially automated Telegram accounts.¹⁰ They are popular tools for a variety of purposes, including creating and managing group chats, acting as personal assistants and providing entertainment.The bots are also used to automate activity outside the app. ⁶ The Evolution of Telegram — September 2020 ⁷ Search Filters, Anonymous Admins, Channel Comments and More ⁸ WhatsApp Blog:Reactions, 2GB File Sharing, 512 Groups ⁹ Instagram group chat size limits ¹⁰ Bots:An introduction for developers {6}------------------------------------------------ Telegram also has its own cryptocurrency, Toncoin, formerly known as Gram, which is a token native to The Open Network, a blockchain-based technology developed by Telegram (TON, formerly Telegram Open Network).In April 2022, Telegram allowed its users to send Toncoin directly from chats within the app.In addition, Telegram now supports Toncoin transactions with no fees attached.¹¹ Due to these features, Telegram became a tool that enables users and companies to build communities, promote their products and more.In fact, at the end of 2020, the sales volume on Telegram was reported to have reached\$25 million.Goods from China had the highest sales volume in 2020, over\$12 million.Products sold on Telegram included digital equipment, consumer loans, apparel and shoes. ![Horizontal bar chart showing sales volume on Telegram worldwide in 2020 by segment.The chart lists ten categories with their respective sales volumes in 1,000 U.S.dollars.'Good from China' has the highest volume at 12,000.89, followed by 'Digital equipment' at 5,522.39 and 'Consumer loans' at 3,120.34.](c64e9e9f3b0b828a5f6ac70441877764_img.jpg) | Segment | Sales Volume (in 1,000 U.S.dollars) | |-----------------------------|--------------------------------------| | Good from China | 12,000.89 | | Digital equipment | 5,522.39 | | Consumer loans | 3,120.34 | | Apparel & shoes | 2,137.38 | | Sport | 863.25 | | Work & education | 574.98 | | Hypermarkets | 454.27 | | Health & beauty | 249 | | Furniture & household goods | 63.35 | | Food delivery | 57.14 | Horizontal bar chart showing sales volume on Telegram worldwide in 2020 by segment.The chart lists ten categories with their respective sales volumes in 1,000 U.S.dollars.'Good from China' has the highest volume at 12,000.89, followed by 'Digital equipment' at 5,522.39 and 'Consumer loans' at 3,120.34. Figure:Sales volume on Telegram worldwide in 2020, by segment (in 1,000 U.S.dollars)¹² ¹¹ TON's Twitter ¹² Statista:Sales volume on Telegram worldwide in 2020, by segment {7}------------------------------------------------ ### Why Telegram is Good for Cybercrime Cybercriminals often use the popular platform to exchange information, share tips and tricks, and coordinate activities.User's accounts and channels are commonly advertised on cybercrime forums and other online communities that cater to cybercriminals.Through these forums, criminals can post links to Telegram groups and channels where they can further discuss and collaborate on criminal activities.Telegram can be used to share information about cybercrime techniques, as well as to distribute malicious tools such as password-stealing Trojans, keyloggers and ransomware.In addition, it's also used to facilitate the sale of stolen data and illicit goods and to recruit new members for criminal activities. ![A screenshot of a forum post from 'Realdealexpensive' advertising a database leak and MSR cards, with links to Telegram accounts.](e0ebcd8fdcfd34b12de3601b59505fdd_img.jpg) Totally have 2 Million 552 Thousand 222 Person Information. Example will not be thrown out of topic, but picture, file size proofing etc.can be thrown. Only serious buyers write.Nobody is forcing you to take it. Although we have not determined the price yet, we are open to negotiation, offers will be evaluated. Contact Telegram @YourAnonSpider Database Has Been Leaked by KromSec! --- Today, 03:04 #1 **Realdealexpensive** Junior Member I have everything needed msr cards I just need help with a software and how to properly read/write a card and use it to make profits anyone willing to help telegram me@realdealexpensive Join Date:Jan 2023 Posts:6 Reputation:0 [+/-] Balance:0.00\$ QUOTE QUICK REPLY **Italy:Any bank to order.** **Austria:Sparkasse , Austria Bank.Also any other bank on request.** **As well as all Europe bunq , revolut , wise WU+.To order.** I have the ability to do business accounts.The guarantor of this forum is welcome. About the order, write personal messages on the forum or telegram@BufalloV A screenshot of a forum post from 'Realdealexpensive' advertising a database leak and MSR cards, with links to Telegram accounts. Image:Different threat actors on various cybercrime forums advertising Telegram as their main point of contact Telegram is favored by hackers for a variety of reasons.One of the key reasons is that it prioritizes privacy and security.However, Telegram's standard chat is not fully encrypted – only the client/server is encrypted and kept in the Telegram cloud.¹³ The Secret Chat feature provides end-to-end encryption so that only the sender and receiver can read the messages.This makes it difficult for anyone who isn't involved in the chat to intercept ¹³ Switched to Telegram? You need to know this about its encryption {8}------------------------------------------------ and read the messages without being intercepted by third parties.This is a critical feature for consumers who value their privacy and wish to safeguard their personal information. The anonymity of Telegram is one of the main reasons it appeals to hackers.Telegram allows users to register accounts without disclosing personal information, making it simple to set up many identities and use them to converse without revealing one's genuine identity.Because of this anonymity, law enforcement organizations have a tough time tracking down and identifying individuals who are using the program for illicit activities.¹⁴ Telegram users can sign up with virtual numbers or foreign phone numbers that are unrelated to their true identities.Users can also register for the service via a one-time SMS service, with the OTP number given to the one-time SMS service rather than their private phone.The latest update (version 9.2) introduced the Fragment blockchain platform, which allows users to buy anonymous numbers with Toncoins and sign up for Telegram without a SIM card.¹⁵ Furthermore, Telegram allows users to create multiple accounts and switch between them easily, which makes it difficult for security researchers to track and identify individual users.This can make it challenging to gather evidence and build a case against cybercriminals using the platform. While Telegram's privacy policy states that it may disclose a user's IP address and phone number to authorities if presented with a court order on terrorism-related charges, the company claims it hasn't done so yet.However, recent investigations in Germany have revealed that the platform is sharing user data with government agencies and censoring content, despite its promise to keep users' data secure and private.¹⁶ Telegram has been forced to disclose user data by court order, and German authorities have received data on suspected terrorists and child abusers.Telegram stores its data worldwide in various data centers and can be forced to reveal or share user data only if it receives multiple court orders from different jurisdictions, like the case in Germany. Telegram has also become the app of choice for extremists and hacktivists because of its loose moderation measures.It creates and enforces its own rules and processes requests to take down illegal public content.It won't censor content based on political motivations or peacefully expressed alternative opinions but will block terrorist-related content.Telegram is attempting to deal with the increase in users and removes channels that include white nationalist content.However, it has been erratic in following its rules against encouraging violence, and policing the service remains challenging.Extremist channels can still be found, and Telegram didn't close some cases that were reported to it in the past, such as a manifesto about killing Muslims and doxing information.¹⁷ The questions of whether Telegram should boost its moderation efforts and whether context should be considered while engaging in moderation remain unanswered.Many cybercriminals, as KELA observed from their chatter, value Telegram's user-friendly ¹⁴ How Criminals Are Tracked Down on Telegram ¹⁵ No-SIM Signup, Auto-Delete All Chats, Topics 2.0 and More ¹⁶ Telegram Reportedly Handed User Data to German Authorities ¹⁷ Why right-wing extremists' favorite new platform is so dangerous {9}------------------------------------------------ interfaces and that it provides new features before rival chat applications.Its simple interface enables users to access their accounts from the web without having to connect their phones to the internet.However, some people have expressed worries about its security and privacy, claiming that the encryption may not be safe enough for some users.Other cybercrime users have voiced concerns about the obligation to register with a phone number when using Telegram, but this has subsequently altered.Overall, it appears that users have differing ideas on the benefits of using Telegram, with some preferring to use alternative messaging apps such as Signal. ![A screenshot of a forum post from BreachForums discussing Telegram's privacy and features.The post is divided into several sections of text in white on a dark background.](07f537f57749b75157f742525e6a8dbc_img.jpg) Firstly Telegram IS NOT ANONYMOUS ! bruha And yes there are loads of alternatives which i even recommend. Signal, Session, Wire & Wickr..... I rest my case. This is my personal opinion.In many aspects, Telegram is superior.It allows you to access your Telegram account from their web interface without having to connect your phone to the internet(A feature/bug of WhatsApp that I find incredibly annoying). It feels faster and brings new features earlier than WhatsApp. I could go on, but all in all, it's up to what your friends are using as you cannot use any messaging platform in isolation. Telegram is not very privacy focused at all, and I agree with your previous points; I have an account but don't really like the platform at all, there are many options that exist which would be better. cuz it's quick and easy the only part i fucking hate about it is the fact it requires a phone number other than that, it's pretty good Image:Chatter about Telegram on BreachForums, a prominent cybercrime forum A screenshot of a forum post from BreachForums discussing Telegram's privacy and features.The post is divided into several sections of text in white on a dark background. Compared to cybercrime forums, Telegram channels and groups are easier to find:just typing a relevant word in the search bar would bring some communities of interest, for example, groups and channels that sell and share data.One will have to put in much more effort to find cybercrime forums and markets since many of them are not indexed by search engines and don't have indicative names.They also require users to create accounts and become members in order to view and acquire their content.For some, access is granted upon review by the forums' administrator, and for others, membership may be granted for a fee.Because Telegram is much easier to join, it's becoming increasingly popular with threat actors. #### Cybercriminals' Language on Telegram Cybercriminals frequently use English on Telegram because it's the most widely spoken language on the internet.However, many Telegram groups and channels are dedicated to certain areas or languages, allowing people who speak other languages to converse and exchange information in their native tongues, such as Chinese, Russian, and Arabic.The Translate tool was added to conversations in the November 2022 upgrade, making it simpler to interact across languages and giving.The ability to interact in different languages on Telegram gives cybercriminals a worldwide platform, where crimes can be carried out on a greater scale, making it more difficult for law enforcement authorities to hunt them down and shut them down. {10}------------------------------------------------ In addition to several languages, cybercriminals (on Telegram and on cybercrime platforms in general) frequently use a combination of technical jargon, slang, and acronyms.They do it to illustrate their competence while describing their plans and techniques.Some of these users will also regularly converse using coded or encrypted messages (generated via third-party platforms) which can be decoded only by people who have the necessary decryption key. ### Other Messengers Favored by Cybercriminals Several additional chat applications are popular among cybercriminals, such as Discord, Jabber, Tox and Wickr, with new applications emerging once in a while.Each of these applications has its own set of features and characteristics, but they all provide some amount of secrecy and protection that cybercriminals find appealing. Jabber is a protocol that uses a TCP connection to transmit data.It allows users to communicate through different clients in real time and it seems to be the most popular tool among Russian-speaking hackers.The infamous XSS and Exploit forums have semi-exclusive Jabber servers which allow approved members to use the messenger with no logging and strong privacy. The Wickr Me app, owned by AWS, became popular among reporters and their sources due to its encrypted messaging capabilities.Criminals can communicate on the app and delete their conversations, leaving no evidence behind.The platform has become a popular place for sharing images of child sexual abuse, according to law enforcement.¹⁸ Amazon has announced that it will be shutting down the app at the end of 2023 Tox is a decentralized, encrypted messaging service that doesn't require registration or the submission of personal information like a phone number or email address.Tox encrypts data using peer-to-peer technology and the NaCl library, and users are identifiable by a Tox ID.Voice messaging and screenshot capture are available in Tox clients.Contacts may be added by providing their Tox ID or QR code.One consequence of Tox's P2P architecture is that Tox contacts can see each other's IP addresses, but a non-friend user can't easily discover a Tox user's IP address using only their Tox ID. Discord is a popular chat network that gamers regularly use to interact with one another.It has, however, become a popular platform for cybercriminals, who use it to communicate and organize actions like distributing malicious files and conducting illicit activities.Discord is geared more toward gaming and requires users to join a server in order to communicate with others.It allows up to 500,000 users to communicate with each other at once, making it a good choice for large groups. For a cybercriminal, a combination of these chat applications is a natural state of operations.While Jabber, Wickr and Tox are used for personal conversations, Telegram and Discord are the only tools that allow the creation of communities, with Telegram being significantly more popular among cybercriminals. ¹⁸ Amazon's Encrypted Chat App Faces Charges Of Child Abuse {11}------------------------------------------------ **Section #2** ### **Types of Crimes** --- {12}------------------------------------------------ ![Abstract background with overlapping white waves on a light gray background.](aeab325055073a3fa4383314ed10d8af_img.jpg) Focus #### Personal & Corporate Data --- {13}------------------------------------------------ ● **Personal data** refers to information that relates to an identifiable individual.This can include a wide range of information, such as name, address, phone number, email address, date of birth and financial information.Personal data is often collected by organizations in the course of their business operations. ● **Corporate data** refers to information that is owned by a company or organization.This can include both personal data related to customers and employees, as well as financial information, and any other information that is relevant to the operation of the organization. Telegram channels and groups are used as platforms to put up for sale and share all sorts of illicitly obtained data, such as information of regular users, corporate documents and accounts, source codes and more.In 2022, it became clear that the amount and diversity of data that can be found on Telegram is comparable to information seen on cybercrime forums and markets. #### Selling Stolen Data For example, usernames and passwords for online resources are readily available on a large number of Telegram channels and groups.The most popular account credentials include online streaming and food delivery services, gaming, retail, banking, mailing and social media.The following example highlights the Telegram channel “Netflix Account Cheap Seller Ott,” which has over 100,000 subscribers and sells compromised accounts for Netflix, Spotify, YouTube and several other services.Potential buyers can select the accounts they wish to purchase according to their validity length (i.e., a month, three months, six months, etc.) and according to their country of interest (US, UK, India, etc.). ![A screenshot of a Telegram channel post from 'Netflix Account Cheap Seller Ott' advertising Netflix account credentials.The post includes a large Netflix logo, a profile picture of the seller, and details about account validity (Monthly, 3 Months, 6 Months, Yearly), a 100% warranty, and contact information.](159f15d60777adb6b16c91d84b32c32f_img.jpg) The image shows a Telegram channel post from "Netflix Account Cheap Seller Ott".The post features a large red Netflix logo with the text "NETFLIX" and "Accounts Lady" below it.To the right, there is a profile picture of a person and account statistics:104K Subscribers, 133 Photos, and 103 Links.The post lists account validity options:Monthly, 3 Months, 6 Months, and Yearly, each with a price placeholder.It also mentions a "100% Warranty Accounts" and "100% Replacement Guaranteed".The seller states they have been serving in Telegram since years and accept payments via PayTm, Phone PE, and PayPal.Contact information is provided as "AccountsLady" and "Prooves:Check".The caption below the image reads:"Image:One of the accounts selling online credentials to Netflix and other services". A screenshot of a Telegram channel post from 'Netflix Account Cheap Seller Ott' advertising Netflix account credentials.The post includes a large Netflix logo, a profile picture of the seller, and details about account validity (Monthly, 3 Months, 6 Months, Yearly), a 100% warranty, and contact information. Similarly, many channels advertise the sale of online banking credentials, which are very sought after in hacking communities.Channels that are dedicated to the sale of such data can be found through a simple search using Telegram’s search bar or through an open-source search engine. Cybercriminals also use Telegram channels to sell and share a wide range of personal {14}------------------------------------------------ identifying information (PII), including Social Security numbers, driver’s license numbers, passports, dates of birth, and physical and email addresses.Below is the channel “Eugene Krabz Shop” (@EUGENEKRABZSHOP), where information databases are offered for sale and can be purchased by messaging the channel’s administrator: ![Screenshot of a Telegram channel post from 'EUGENE KRABZ SHOP' advertising various databases for sale.](0e240e8e4783e664047fbdb5fbd0989f_img.jpg) A screenshot of a Telegram channel post from "EUGENE KRABZ SHOP" (@EUGENEKRABZSHOP).The post, dated 1.3K edited 19:47, lists several databases available for purchase:"FULLZ INFO DATABASES IN STOCK" (including FULL NAME, DATE OF BIRTH, SOCIAL SECURITY NUMBER, ADDRESS, DRIVER LICENSE NUMBER, BANK NAME WITH AN/RN), "DATABASE" (including FULL NAME, DATE OF BIRTH, SOCIAL SECURITY NUMBER, ADDRESS, DRIVER LICENSE NUMBER), and "DATABASE" (including FULL NAME, DATE OF BIRTH, SOCIAL SECURITY NUMBER, ADDRESS, CREDIT SCORE 800+, and a note that CREDIT REPORT/BG REPORT CAN BE INCLUDED).The channel profile shows 811 subscribers, 57 photos, and 6 links, with a "DOWNLOAD TELEGRAM" button. Screenshot of a Telegram channel post from 'EUGENE KRABZ SHOP' advertising various databases for sale. The above post announces the availability of databases that consist of full name, date of birth, Social Security number, address and driver’s license number, and that can include bank names and credit score data. Other offerings include databases with different content types, such as “homeowner,” “insurance leads” or “Medicare,” but also from various countries as stated in the example below, which claims to have data from over 187 countries: Image:A Telegram post from the channel@h3lstrom ![Screenshot of a Telegram channel post from 'H3L TROM BIGBOX' advertising various types of leads and data.](0a5acc4b370bb711096e04f25b8b3feb_img.jpg) A screenshot of a Telegram channel post from "H3L TROM BIGBOX" (@H3lstrom).The post, dated 3965 6:41, states "Any kinds of data or leads available from 187+ countries." It lists various data types:Email leads, Cellphone leads, Payday, Crypto, Forex, Homeowner, Insurance leads, MCA, SSN with DL, Medicare, Solar, and Debt.It also mentions "Over 3M+ data/leads available" and provides links to "Order -@h3lplug" and the channel "@H3lstrom". Screenshot of a Telegram channel post from 'H3L TROM BIGBOX' advertising various types of leads and data. Threat actors may abuse such information to conduct various types of fraud involving the exploitation of stolen identities, including contracting bank loans and opening up bank accounts. While some information mentioned above harms mostly end users (think of a Netflix or bank account owner), in Telegram there’s plenty of data that poses high risk to companies. For example, a compromise can begin with initial access to organizations’ internal resources (usually in form of credentials and the compromised URL) which can be found offered for sale in Telegram.An actor operating the private Telegram channel “0x\_dump” constantly advertises such offers.¹⁹ ¹⁹ Register on KELA’s platform and see a report about the 0x\_dump channel, including details on the threat actor behind the channel identified as a Kenya-based individual. {15}------------------------------------------------ One of the recent examples is the alleged access to an insurance company with a revenue of “about\$165B - 180B” which they claim has over 120 million customers.The threat actor set a price of\$360,000 for the access. ![Screenshot of Telegram messages from 0x_dump discussing insurance company access details, including revenue, stock symbol, and employee count.](9d5d3616a843e8063fdc3613055aaef8_img.jpg) Screenshot of Telegram messages from 0x\_dump discussing insurance company access details, including revenue, stock symbol, and employee count. The following day 0x\_dump announced that the access had been sold: ![Screenshot of Telegram messages from 0x_dump confirming the sale of access, with view and time stamps.](a8e5c2ac336eb43cda4e333ea9c73237_img.jpg) Screenshot of Telegram messages from 0x\_dump confirming the sale of access, with view and time stamps. Once sold, initial access often leads to malicious intrusions and data exfiltration, with this data possibly being sold or leaked later. The self-proclaimed ransomware group Bully Gang discloses its victims’ names on its Telegram channel and offers the alleged victims’ data (accompanied with samples) for sale, as can be seen in the example below:20 ![Composite image showing a data table from a plastic print provider and Telegram messages from 'Bully Gang' offering data samples and a file listing.](63a5a7879cf64a0e3ce5643c8ba1648f_img.jpg) Composite image showing a data table from a plastic print provider and Telegram messages from 'Bully Gang' offering data samples and a file listing. 20 Ransomware and data extortion actors operating via Telegram will be covered in more detail in a separate chapter:“Focus:Ransomware and data extortion groups.” {16}------------------------------------------------ Corporate data exposed by such actors can include contracts, financial information, HR files, developer documentation, sensitive credentials to internal tools and services, intellectual property, trade secrets and proprietary information, and employee and customer data. While both personal and corporate data are considered to be valued information, they're not only offered for sale but are leaked on an everyday basis.For instance, the threat actors operating the channel "Leaked DataBase Breached" were observed posting databases that their subscribers could download freely.The following example shows a data dump from the Japanese chain of music stores which includes over 700,000 records: ![Screenshot of a Telegram message from 'Leaked DataBase Breached' channel.](41245ac07db266bea228735b9e8c8b73_img.jpg) A Telegram message from the channel "Leaked DataBase Breached".It features a blue circular profile picture with a white download arrow.The message text reads:"DiskUnion\_701k.txt 23.9 MB".Below this, it lists details:"Site:diskunion.net", "Catagory:Music And Art" with a music note icon, "Country:Japan" with a Japanese flag emoji, and "Format Of DB:Mail:Pass" with a green checkmark icon. Screenshot of a Telegram message from 'Leaked DataBase Breached' channel. Some well-known cybercrime forums have their own Telegram channels, often used for general announcements (site going offline, new forums' guidelines/rules, etc.) but also to advertise the availability of new content, such as leaked databases.For instance, the popular English-speaking data leaking forum named BreachForums has an official Telegram channel such as previously described: ![Composite image showing a forum post and a Telegram channel profile for BreachForums.](c3ee41c6d46565ab4198d0a9c69108c5_img.jpg) A composite image showing two screenshots.The left screenshot is a forum post from "BreachForums Official Announcements" titled "A new breach has been added to BreachForums Official." It mentions "VBForums (VBForums.com) | 194,837 Records" and details a data breach from July 2016.The right screenshot is a Telegram channel profile for "@breachforums\_cdn" with a red circular logo containing the letters "BA".It shows "2.37K Subscribers" and "329 Links".A blue button labeled "DOWNLOAD TELEGRAM" is visible, along with navigation links:"About", "Blog", "Apps", and "Platform".A large "BF" watermark is overlaid on the bottom right of the forum post. Composite image showing a forum post and a Telegram channel profile for BreachForums. Image:A screenshot from the Telegram channel@breachforums\_cdn announcing the publication of a new database to its forum {17}------------------------------------------------ ![Screenshot of a BreachForums post about a VBForums database leak, showing user statistics and a description of the data breach.](97fe9069356cc2a84e8e70673e405958_img.jpg) Screenshot of a BreachForums post about a VBForums database leak, showing user statistics and a description of the data breach. Such leaks start a never-ending circulation of data among cybercriminals, and Telegram plays a vital role in this process. ##### Resharing Stolen Data Once information is made public, it’s common in cybercrime communities to reshare data.As a result, many corporate databases are posted numerous times on specialized Telegram groups and channels.Such channels and groups are easily available, and some have thousands of subscribers. ![A collage of three Telegram channel screenshots showing shared links to leaked databases like 'Dataleak', 'Leaked Database', and 'Leaked Detabase'.](06eef9cc3970450903c158ec25346d21_img.jpg) A collage of three Telegram channel screenshots showing shared links to leaked databases like 'Dataleak', 'Leaked Database', and 'Leaked Detabase'. Data leaked by ransomware and extortion gangs is often found on such Telegram channels.For example, Singapore Telecommunications Limited, also known as Singtel, was claimed as a victim of the Clop ransomware in February 2021; the company’s data was posted on the ransomware public “shaming” website (blog).Soon KELA observed it reshared in the private channel “Ares Channel (VIP),” from there it was shared once more by “Leaks Aggregator,” which is a public Telegram channel – and who knows how many more times? {18}------------------------------------------------ ![Two side-by-side Telegram chat screenshots showing data leaks.](1630bfd9ebf9b95faec11ae6cdfd9c0a_img.jpg) The image shows two side-by-side Telegram chat interface screenshots.The left screenshot is from a channel titled 'LEAKS AGGREGATOR | УТЕЧКИ АГРЕГАТОР...Forwarded from ARES CHANNEL (VIP)'.It contains two messages, each with a blue circular icon with a white downward arrow.The first message is for 'singtel.com.7z.001' (4000.0 MB) and the second is for 'singtel.com.7z.002' (4000.0 MB).The right screenshot shows three similar messages in a channel titled 'LEAKS AGGREGATOR | УТЕЧКИ АГРЕГАТОР | БАЗЫ ДАННЫХ | СЛИВ'.The messages are for 'singtel.com.7z.003' (4000.0 MB), 'singtel.com.7z.004' (4000.0 MB), and 'singtel.com.7z.005' (4000.0 MB).Each message also features a blue circular icon with a white downward arrow. Two side-by-side Telegram chat screenshots showing data leaks. Other Telegram channels aggregate data from many different sources and provide all the leaked data in their channel, making it easier for users looking for such data to browse the available information.The channel titled “LEAKS AGGREGATOR | УТЕЧКИ АГРЕГАТОР | БАЗЫ ДАННЫХ | СЛИВ,” as its name indicates, gathers public data leaks and aggregates them. Image:The screenshot above shows three leaks, which were first posted in three different Telegram-based sources and then forwarded to the Leaks Aggregator channel ![A Telegram chat screenshot showing three forwarded messages about data leaks.](6551284cc15a2ba106451485aaac265a_img.jpg) The image is a screenshot of a Telegram chat window titled 'LEAKS AGGREGATOR | УТЕЧКИ АГРЕГАТОР | БАЗЫ ДАННЫХ | СЛИВ' with 3,682 subscribers.It displays three forwarded messages.The first message is from 'Retard Cloud' and contains a file named 'school.mos.ru.zip' (1107.9 MB) with a view count of 252 at 7:52.The second message is from 'ZELENKA базы (BIO | Recently)' and contains a file named 'NHTUBD.tar' (664.7 MB).Below the file name is a Russian text:'В Uber произошла крупная утечка данных' and a handle '@bazu\_ru'.It also includes a note about data being fabricated and a link to 'https://www.random.org' with a view count of 310 at 7:52.The third message is from 'LEAKINFORMATION' and contains a file named 'academicedu.org.rar' (377.2 KB).Below the file name is the text 'emails and plain pass password:' followed by a string of asterisks. A Telegram chat screenshot showing three forwarded messages about data leaks. Such actors allow potential interested parties to acquire information more easily than cybercrime platforms do because they are more accessible; they don’t require users to sign up and create an account.Therefore, when reviewing Telegram channels and groups, KELA often sees that the primary source of the leaked data is a cybercrime forum. For example, a database from “axess.fr” was posted on Club Hydra Forum and shared on the “LEAKINFORMATION,” “Leakbase.cc” and “Dataleak” Telegram channels: {19}------------------------------------------------ ![Screenshot of a Club Hydra Forum post titled 'axess.fr SQL LEAKED | 2022' by user PAVLOV.The post includes a profile picture, a 'ADMINISTRATOR' badge, and a list of data fields:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.A link to purchase VIP is also visible.](63c666b05041841b01fdef9fa4153ff7_img.jpg) Screenshot of a Club Hydra Forum post titled 'axess.fr SQL LEAKED | 2022' by user PAVLOV.The post includes a profile picture, a 'ADMINISTRATOR' badge, and a list of data fields:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.A link to purchase VIP is also visible. Image:"axess.fr" database shared on Club Hydra Forum ![Screenshot of a Telegram channel post from LEAKINFORMATION sharing 'axess.fr.sql' (4.6 MB).The post lists the same data fields as the Club Hydra post:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.It also mentions 'AXESS.FR DB LEAK' and 'credits:leakbase'.](6c87dea9e65426eedb6b2a6838b12274_img.jpg) Screenshot of a Telegram channel post from LEAKINFORMATION sharing 'axess.fr.sql' (4.6 MB).The post lists the same data fields as the Club Hydra post:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.It also mentions 'AXESS.FR DB LEAK' and 'credits:leakbase'. ![Screenshot of a Telegram channel profile for@leakinformation.It shows 1.34K subscribers, 15 photos, 2 videos, 79 files, and 56 links.A bio states:'all leaks are for research purposes, and this are not our leaks.password:leakinformation Source of leaks:google'.It also lists partners like@cents4life.](72dc35c6c075018909676f36a0a98af1_img.jpg) Screenshot of a Telegram channel profile for@leakinformation.It shows 1.34K subscribers, 15 photos, 2 videos, 79 files, and 56 links.A bio states:'all leaks are for research purposes, and this are not our leaks.password:leakinformation Source of leaks:google'.It also lists partners like@cents4life. Image:"axess.fr" database shared on LEAKINFORMATION ![Screenshot of a Telegram channel post from Leakbase.cc sharing 'axess.fr.sql' (4.6 MB).The post lists the same data fields as the previous posts:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.It also mentions '@leakbase_cc'.](d634064028e40596aebaa55b4f9700cc_img.jpg) Screenshot of a Telegram channel post from Leakbase.cc sharing 'axess.fr.sql' (4.6 MB).The post lists the same data fields as the previous posts:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.It also mentions '@leakbase\_cc'. Image 3:"axess.fr" database shared on Leakbase.cc ![Screenshot of a Telegram channel post from Dataleak sharing 'axess.fr.sql' (4.6 MB).The post lists the same data fields as the previous posts:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.It also mentions 'AXESS.FR database'.](215ea7e1fe910034899bf51a825d5e9c_img.jpg) Screenshot of a Telegram channel post from Dataleak sharing 'axess.fr.sql' (4.6 MB).The post lists the same data fields as the previous posts:id, tstamp, firstname, lastname, dateOfBirth, gender, company, street, postal, city, state, country, phone, mobile, fax, email, website, language, groups, login, username, password, assignDir, homeDir, disable, start, stop, dateAdded, lastLogin, currentLogin, loginCount, and locked.It also mentions 'AXESS.FR database'. Image 4:"axess.fr" database shared on Dataleak {20}------------------------------------------------ It is interesting to note that the data shared on forums is usually “conditionally free”:it is often available against forum credits, which can be bought for a relatively cheap price but still cost money.The same databases are usually shared for free on Telegram, as once it has become public it is less valuable and may be distributed freely. ***Case study for this chapter:SiegedSec*** ### Why Telegram is Good for Cybercrime |

Image:Icon of a person with a list

Image:Icon of a document and pencil

Image:Icon of three people

Image:Icon of a speech bubble with 'A' and '文'

| |----------------------------------------------------------|----------------------------------------------------------|------------------------------------|--------------------------------------------------------| | Name | Description | Members or Followers | Language | | Unsafe Internet | A database sharing channel | >1,900 | English | | Dataleak | A private channel that shares databases | >1,300 | English | | LEAKS AGGREGATOR УТЕЧКИ АГРЕГАТОР БАЗЫ ДАННЫХ СЛИВ | A data leaks aggregating channel | >3,700 | Russian | | 0x_dump | A private channel that leaks its own databases | >900 | English | | Leakbase.cc | A database sharing channel | >3,200 | English | | A r e s 🗝️ | A private channel where databases are shared and sold | >7,300 | English | | 全球数据市场 Global Data Market | A channel that sells databases | >3,800 | Chinese | | Leaked Database | A database sharing channel | >3,700 | English | | MAKE 🏦 THE 🏦 BANDS HERE 🇺🇸 🇯🇴 | A group that sells and shares banking data, PII and more | >7,000 | English | | Базы данных/БД/Утечки информации/Архив | A channel that shares databases and PII | >5,000 | Russian | | Hades Database | A channel that sells and shares databases | >1,600 | English | {21}------------------------------------------------ ![Abstract background with overlapping white waves on a light gray background.](0c726fb5109fcf7799a12141a3e5483d_img.jpg) Focus #### Information Stealers --- {22}------------------------------------------------ #### Clouds of Logs - **Info-stealing malware** gathers information, usually credentials, from an infected machine.Stolen credentials “packages” are then referred to by cybercriminals as “logs” and the infected machines they came from – as “bots”.The information can be stolen through **commodity stealers** such as Redline, Raccoon, Meta and Vidar (working as malware-as-a-service), and **custom-made, private stealers**. The stolen information usually includes user login credentials, browsing history, cookies, authentication tokens and information about the user’s machine.If purchased by threat actors, these credentials pose a significant risk to an organization, because they allow actors to access various resources that could result in data exfiltration, lateral movement and malware deployment. Logs can be sold on **automated botnet markets** such as RussianMarket, TwoEasy and Genesis, but they are also sold and leaked on cybercrime forums and across different platforms, with Telegram becoming one of the important channels to distribute logs.In recent years, a new type of product emerged:“**clouds of logs**”, meaning that threat actors are selling access to their collections of files via private cloud-based platforms for a subscription fee.These “clouds” can be hosted on file sharing platforms, such as MEGA or Yandex Disk, and Telegram is also becoming such a platform due to its ability to store big files, as observed by KELA. Telegram became one of the popular platforms for cybercriminals to advertise, sell and leak logs harvested by information-stealing malware.Using the advantages of Telegram, actors created dedicated channels that allow access to credentials, helping cybercriminals to manage massive datasets and deliver large amounts of stolen data.When using legitimate file-sharing services for selling logs, cybercriminals have to deal with moderation that frequently deletes illegal information.Telegram’s moderation is more lenient, attracting both sellers and buyers.Particularly interesting are actors who use Telegram to share their private logs collected by custom or commodity stealers.Traditionally they call them “clouds of logs” and offer to rent access to private Telegram channels collecting these logs.Some actors offer a small amount of logs for free as part of promoting their paid services. ![Screenshot of a Telegram channel post from REDLINEVIP advertising free logs.](0ab720844e454afef91e5d68f4ab8ad9_img.jpg) A screenshot of a Telegram channel post from 'REDLINEVIP'.The post is titled 'Forwarded from REDLINEVIP (Rdx)' and contains the text 'Free Fresh logs drop at 150 reaction'.Below this is an 'Anonymous Poll' with two options:'Sort logs' and 'Simple logs', both with emptyradio buttons.It shows '224 votes' and reaction icons:11 thumbs up, 4 hearts, and 1 fire.The post is from 'Rdx' at '2:12 PM' and has '10 comments'.At the bottom, there is a caption:'Image:As part of promotion, some actors a number of reactions from users and then allow them to download free logs'. Screenshot of a Telegram channel post from REDLINEVIP advertising free logs. For “private” clouds, access is given usually via an administrator of a channel following the subscription payment.The prices vary among threat actors and are usually in a range of hundreds (for a month) to several thousand USD (for lifetime access).For example, in the channel “REDLINEVIP,” the cheapest price is a weekly access for USD 200, while permanent access costs USD 2,200.In the channel “cBank [LOGS]”, the premium logs channel costs USD 100 per week or USD 3,000 for lifetime access.²¹ ²¹ Register on KELA’s platform and see a report on cBank [LOGS], containing information about the channel and identification of the threat actor behind the channel as a Russia-based individual. {23}------------------------------------------------ Image:Cloud icon Welcome to the [@FATHEROFCARDERS](#) [LOGS] cloud Image:Cloud icon Image:Private group icon Private group Image:Subscription plans access icon Subscription plans access Image:Fire icon - This group is made for share free logs - Logs obtained from my very own Stealers - We use few private stealers to get logs - Free logs post from private group - Logs post daily - Telegram private group access - Daily 500-1000 PCS logs - Logs are fresh 1-3 days old - Geo USA, EU, MIX - Working cookies - Full log info - Wallets - Week\$200 - 1 Month\$400 - 2 months\$600 - 3 months\$800 - Lifetime\$2200 \$ Payment BTC/ETH/LTC/USDT\$ Image:REDLINEVIP channel advertised the subscription plan The number of logs that could be accessed during the subscription varies.For instance, monthly subscribers on Snatch Premium Cloud would receive around 90,000 logs per month for USD 250.To provide more unique information, some actors limit the number of users who can access and buy logs:for example, “3 seats available in private cloud #1.” LOGS ARTHOUSE CLOUD Image:Logo LOGS ARTHOUSE CLOUD Contact me pm [@Barlington\\_1](#) 3 seats available in private cloud #1, 8 seats available in private cloud #2 Contact me pm [@Barlington\\_1](#) Image:Eye icon 1297 edited 1:45 AM Image:Profile picture Image:Profile picture 8 comments > Image:“ArtHouse Cloud limits the number of users accessing the cloud HUBLOGS Image:Download icon LEAK 28.08@HUBLOGS 1100PCS.rar 765.5 MB - 170 reactions in this post for new drop! - HUBLOGS PRIVATE - 2/10 available seats - contains more 1.240.000 logs Image:Like icon 82 Image:Fire icon 14 Image:Eye icon 4611 10:37 AM Image:Comment icon Leave a comment > Image:2 slots available of HubLogs Cloud Leaks of logs advertised for sale or for free sometimes include useful details regarding the leak, such as timeframe when the logs were stolen, geographies of the compromised machines, amount of logs, and source (information stealers). When analyzing several most prominent Telegram clouds of logs, KELA found that the majority of the logs shared on these channels were obtained using the Redline stealer. SNATCH LOGS CLOUD Image:Download icon SEPT 30 - OCT 4@SNATCH\_CLOUD#12.rar 276.8 MB Image:Download icon SEPT 30 - OCT 4@SNATCH\_CLOUD#13.rar 284.8 MB Image:Download icon SEPT 30 - OCT 4@SNATCH\_CLOUD#11.rar 387.3 MB Image:Search icon DATE 30.09-4.10 Image:Link icon TARGET MIX Image:File icon AMOUNT 3.078 PCS Image:Eye icon 2927 edited 9:09 PM Image:Post shared on Snatch Logs Cloud When analyzing several of the most prominent Telegram clouds of logs, KELA found that the majority of the logs shared on these channels were obtained using the Redline stealer. {24}------------------------------------------------ ![Bar chart showing the distribution of bots offered for sale on Telegram channels.The y-axis represents the number of bots, ranging from 0 to 30,000,000.The x-axis lists six bots:Redline, Vidar, MetaStealer, Mars, Raccoon, and AZORult.Redline has the highest number of bots at 27,298,547, followed by Vidar at 617,908, MetaStealer at 150,673, Mars at 112,396, Raccoon at 100,027, and AZORult at 38,950.](5500ab73cf84ccc0055eecf28889b4db_img.jpg) | Bot Name | Number of Bots | |-------------|----------------| | Redline | 27,298,547 | | Vidar | 617,908 | | MetaStealer | 150,673 | | Mars | 112,396 | | Raccoon | 100,027 | | AZORult | 38,950 | Bar chart showing the distribution of bots offered for sale on Telegram channels.The y-axis represents the number of bots, ranging from 0 to 30,000,000.The x-axis lists six bots:Redline, Vidar, MetaStealer, Mars, Raccoon, and AZORult.Redline has the highest number of bots at 27,298,547, followed by Vidar at 617,908, MetaStealer at 150,673, Mars at 112,396, Raccoon at 100,027, and AZORult at 38,950. Figure:Distribution of bots offered for sale on Telegram channels called Snatch, Redlinevip and Cbank logs As with all the data, once logs are leaked for free, they start to widely circulate across Telegram and other platforms, that are not necessarily focused on logs.For example, the threat actor named LeakBase (known for leaking databases on the BreachForums and operating their own site for the same purpose) is using a Telegram channel to share information coming both from their attacks and other threat actors.In addition to databases, the actor shares collections of logs, and the names of the files usually imply the logs were obtained via the aforementioned clouds, providing a glimpse into the most prominent log cloud services that exist in the cybercrime underground. ![Screenshot of a Telegram channel named 'Leakbase.cc | Official Channel' showing a list of shared log files.The files include@mooncloud2.rar (1789.2 MB), 2000 CLOUD_COSMIC.rar (1017.8 MB), Enot logs.rar (800.1 MB), Eternity&Team Cloud 2.rar (799.5 MB), THOR LOGS.rar (799.5 MB), 1000 PCS - 31.08.2022.rar (720.5 MB), Eternity&Team Cloud.rar (708.0 MB), and THOR LOGS2.rar (708.0 MB).The channel handle is@leakbase_cc and it has 909 members, edited at 4:41 AM.](810c7bd381c13911f72d22587ad08606_img.jpg) Leakbase.cc | Official Channel @mooncloud2.rar 1789.2 MB 2000 CLOUD\_COSMIC.rar 1017.8 MB Enot logs.rar 800.1 MB Eternity&Team Cloud 2.rar 799.5 MB THOR LOGS.rar 799.5 MB 1000 PCS - 31.08.2022.rar 720.5 MB Eternity&Team Cloud.rar 708.0 MB THOR LOGS2.rar 708.0 MB @leakbase\_cc 909 edited 4:41 AM Screenshot of a Telegram channel named 'Leakbase.cc | Official Channel' showing a list of shared log files.The files include@mooncloud2.rar (1789.2 MB), 2000 CLOUD\_COSMIC.rar (1017.8 MB), Enot logs.rar (800.1 MB), Eternity&Team Cloud 2.rar (799.5 MB), THOR LOGS.rar (799.5 MB), 1000 PCS - 31.08.2022.rar (720.5 MB), Eternity&Team Cloud.rar (708.0 MB), and THOR LOGS2.rar (708.0 MB).The channel handle is@leakbase\_cc and it has 909 members, edited at 4:41 AM. Image:LeakBase shares different logs files downloaded from different cloud services Over the past years, cybercriminals have frequently used compromised credentials from logs as an entry vector, targeting high-profile companies such as Uber, T-Mobile and Electronic Arts.²² Adoption of Telegram by actors using info-stealing malware increases the number of potential buyers and subsequently the number of victims. ²² See KELA's blog:*Defender-in-the-middle:How to reduce damage from info-stealing malware* {25}------------------------------------------------ #### Info-stealing Malware Communities ● Commodity stealers operate as malware-as-a-service, providing access to their malware and admin panel for a fee.There are different threat actors involved in such operations, and they usually form **teams** to work with several stealers' operations.Teams' administrators acquire access to infostealers' malware by paying a subscription fee per month or for unlimited time.To spread the malware, they **hire traffers** — these actors are responsible for redirecting users' traffic to malicious content.A team's admin manages the traffers' team and provides them with **encrypted builds** (a version of malware that has been created or compiled from its source code and obfuscated to evade detection).Traffers spread the malware, using the teams' delivery methods, and gain money based on the quantity and quality of logs generated by each infection.Admins employ stolen logs for further attacks or simply sell them. Telegram is used by actors employing info-stealing malware not only to sell and share harvested data.Commodity infostealers provoked the emergence of cybercriminal gangs and teams working together to infect as many people as possible.To coordinate their activities, many use Telegram, creating all types of tools:channels for hiring new traffers and advertising the team, public and private chats for coordinating activities and discussions, and Telegram bots for automating tasks, payments and more (see the next section). In their turn, administrators of commodity infostealers' affiliate programs use Telegram to promote their activities, announcing and releasing updated versions of infostealers on dedicated Telegram channels.Telegram has become a vital tool in the infostealers' landscape that has expanded this year, giving different threat actors the opportunity to take part in the infection chain and facilitating the process.²³ ##### Telegram Bots Used by Infostealers When it comes to infostealers, Telegram is used not only to form communities and collaborate.Because this messenger allows the creation of bots that can interact with outside platforms, it has become a valuable tool to be used in infostealers' command and control (C&C) infrastructure.It's mostly used to save and share data harvested by malware. For example, the Eternity Project, which is malware-as-a-service, uses Telegram bots to sell stolen information to actors who bought access to the service and to provide them with an opportunity to build the binary.The stealer doesn't have an administrator panel to manage the malware and attacks — everything is done via Telegram, as the project developers say. ![Screenshot of a Telegram chat group named 'EternityTeam' showing a message from a bot asking 'Does it have a panel or everything is via TG?' and replying 'Hi.Tg bot.'](9887cf85c05205c57271d28ecc108b32_img.jpg) A screenshot of a Telegram group chat named "EternityTeam".The chat shows a message from a bot with a green profile picture.The bot's name is "EternityTeam" and its role is "CD-диск Пользователь".The message says "Пятница в 21:29" (Friday at 21:29).The bot asks "SyCo сказал(а):📎 Does it have a panel or everything is via TG?" and the bot replies "Hi.Tg bot." Below the chat screenshot is a caption:"Image:Developers of the Eternity Project confirming the admin panel is operated in Telegram". Screenshot of a Telegram chat group named 'EternityTeam' showing a message from a bot asking 'Does it have a panel or everything is via TG?' and replying 'Hi.Tg bot.' ²³ See KELA's report:*The Next Generation of Info Stealers* {26}------------------------------------------------ Some other projects that offer to send stolen logs through Telegram include Agrat, Ikarus and multiple unnamed stealers, all of which have relatively low prices (lifetime access for USD 100–300).Therefore, it seems that Telegram allows less skilled or less resourceful malware developers to easily build C&C infrastructure for their projects. Telegram bots for infostealers are also offered as standalone projects that can be used with different malware-as-a-service.For example, developers of SantaresBot offer to administrators of teams manage their traffers via Telegram.The bot allows them to distribute builds to traffers, receive logs and check if they are valid, communicate with team members and more.The bot allows customization for each user and claims to work with Redline, Racoon, Meta, 000 and Aurora stealers, but the developers also mention they can implement any stealer that automatically saves stolen logs.Many other bots offer similar functionality and additional features, such as crypting infostealer builds through Telegram, incorporating builds into alleged benign files and more. ##### **Buying Santares Bot , you get** - Customization of functionality for your needs - Installing a bot on a server - Bot source code - Support for all issues ### **Why are we better than our competitors?** - CryptoChecker for 3 wallets (MetaMask, Ronin , Brave) - YT checker that does not kill cookies - The ability to connect any services with an API (cryptocurrencies, video downloads, cheating, etc.) - Cutting requests from logs with convenient settings - File manager of personal logs with information about them right in the bot - Using the async library - Self -written Loader in C# for your files - Anti ddos system - Generation of unique links with an expiration date (for chat, unsubscribe, etc.) - UPX for Aurora builds - Rank system to limit the use of tools - Referral system Image:SantaresBot advertisement (auto-translated from Russian) Telegram bots are used in C&C infrastructure of different malware strains, but especially in the infostealers community they have become a valuable and popular tool. ### **Case study for this chapter:REDLINEVIP and Palm Team** {27}------------------------------------------------ #### List of Prominent Groups and Channels | Group icon

| |----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------| | Name | Description | Suscribers | Language | Created | | REDLINEVIP | Free logs and access to private cloud | >6000 | English | Sep 2021 | | Snatch logs cloud | Free logs and access to private cloud | >5800 | English | Sep 2021 | | LOGS ARTHOUSE CLOUD | Free logs and access to private cloud | >5300 | English | Sep 2021 | | Cosmic CLOUD | Free access to logs and private cloud | <5000 | English | Aug 2021 | | HUBLOGS | Free logs and access to private cloud | >4850 | English | Jan 2022 | | LeakBase | Free logs and dumps and access to private cloud | >3300 | English & Russian | Jan 2022 | | SHARKCLOUD | Free distribution of logs | >3100 | Russian | Sep 2022 | | DaisyCloud | Free logs and dumps and access to private cloud | <2500 | English | July 2022 | | Total Cloud Агрегатор логов | Free logs and access to private cloud | <2300 | Russian | Dec 2020 | | Noxy Cloud | Free access to logs and private cloud | >1400 | English | Aug 2022 | | METASTEALER OFFICIAL | META stealer | >7740 | Russian | Aug 2022 | | AURORA BOTNET STEALER | Aurora stealer | >3300 | Russian & English | May 2022 | | Blackwalter | Blackwakter stealer | >1800 | English | March 2020 | | Eternity | Eternity stealer | >1200 | English & Russian | May 2022 | | Rhadamanthys | Rhadamanths | <1350 | English | Oct 2022 | | REIMANN CHAT | Reimann chat | <1200 | Russian | May 2021 | {28}------------------------------------------------ | | | | | | |--------------|-------------------|------|---------|------------| | РАЙ ТРАФЕРА | Traffers Paradise | <240 | Russian | Oct 2022 | | Palm Team | Palm Team | <200 | Russian | July 2022 | | OverDox Team | OverDox services | 170 | Russian | March 2022 | | Sky Team | Sky SEO team | 25 | Russian | Aug 2022 | {29}------------------------------------------------ **Focus** #### **Banking Fraud** --- {30}------------------------------------------------ - **Banking fraud** refers to criminal activities that target the financial institutions, their employees and their customers.These crimes can take many forms, including common attacks, such as phishing, and industry-specific attacks, including: - **Credit card skimming**, which involves stealing credit card information by attaching a device to PoS terminals or ATM machines card reader - **Card cracking**, which refers to the use of stolen or compromised credit or debit card information to make unauthorized purchases or withdrawals - **Money muling**, which refers to the transfer of money obtained through illegal activities through a series of transactions in an attempt to conceal its origin More slang terms that are commonly used in the context of banking cybercrime include **shimmer**, which is a type of device used to capture card information from the magnetic strip of a credit or debit card when it's inserted into an ATM or other card reader; and **fullz**, which refers to a package of personal identifying information used to commit fraud or other crimes.The term is often used in the context of identity theft, and may include information such as a person's name, address, date of birth, Social Security number and financial account numbers.Threat actors may use this information to open new accounts or make unauthorized purchases or withdrawals. - **Credit card markets** refer to platforms selling various types of credit cards, such as Omerta, Brian's Club and Yale Lodge.One of the types that the underground credit card market consists of is compromised cards with CVV/CVV2 information, which includes a three- or four-digit security code used for online or phone purchases.This type is the most targeted one due to the anonymity of "card-not-present" purchases, the potential for additional personal information to be included with the cards and the ability to use it immediately. Another important aspect is checks that may be used in a variety of ways as threat actors may create and use **fake checks** to defraud individuals or businesses. Cybercriminals also create **banking fraud tutorials** that include instructions on how to open and manage bank accounts, steal credit card information, fake checks and defraud individuals or businesses.These resources can be used by individuals who are new to banking fraud or who want to learn more about all this illegal activity. - **Bank logs** refer to the details of an individual's account login information such as username, email, cookies, and account details.Cybercriminals use phishing techniques to obtain this information by creating fake login sites and sending them to targets.When a target enters their login information on these fake sites, the cybercriminals capture the information and use it for fraudulent activities. {31}------------------------------------------------ In the last few years, all activity mentioned above is happening in Telegram as well.It became a popular platform for banking fraud cybercriminals who created dedicated channels for advertising stolen credit card information and checks, fullz and financial accounts.Forged credit cards and banknotes are also a popular item for sale.For example, sellers claim that they provide a cloned ATM card with a PIN and add clear instructions: ![Telegram message from 'THE COUNTERFIET SHOP' showing instructions for withdrawing money from an ATM using cloned cards.](c97a6f80a417c2fb26707e3f4823e597_img.jpg) My Clones now work world wide tested in atleast 30-50 countries in each continent Steps of pulling money from ATM Step 1:Insert ATM Card. Step 2:Select the Language. Step 3:Enter 4 Digit ATM Pin. Step 4:Select Your Transaction. Step 5:Select Your Account. Step 6:Enter the Withdrawal Money. Step 7:Collect the Cash. Step 8:Take a Printed Receipt. Counterfeit checks and stolen valid checks channels are common on Telegram.Fraudsters are sending those checks and money orders to other cybercriminals and to people as part of scam schemes, asking them to deposit the check into their bank account and return part of the money in cash or by wire transfer. Banking fraud tutorials are also found on Telegram as actors want to share their knowledge.For example, the owner of the channel “ALL BANK TUTORIALS (PRIVATE)” shares some tutorials they have: **ALL BANK TUTORIALS (PRIVATE)** Forwarded from ALL BANK TUTORIALS (PRIVATE) (Draco) ![Screenshot of Telegram channel posts showing links to download banking tutorials.](f6a11dd0bdaa9a329c727f57f143c317_img.jpg) MOBILE DEPOSIT(MD) COMPLETE TUTORIAL.pdf 128.6 KB [DOWNLOAD](#) HOW TO LOAD CASHAPP WIL...G by@therealdrac0.pdf 106.5 KB [DOWNLOAD](#) ZELLE INSTANT TRANSFER...OD by@therealdrac0.pdf 86.2 KB [DOWNLOAD](#) The use of Telegram bots allows actors to automate various attacks, among them operations targeting banking users.By using automated bot services to send these messages, actors can potentially reach a larger number of victims more efficiently or delegate social engineering to other cybercriminals for a fee.For instance, SMSRanger is an OTP & SMS capture bot that is capable of getting OTP & SMS codes from victims by impersonating a company or bank.In the Telegram channel ‘SMS Ranger | Updates’ which has around 7700 subscribers, the admin advertised some examples as proof of the bot’s success: {32}------------------------------------------------ ![Two screenshots of Telegram bot interfaces.The left screenshot shows a balance of $9,380.65 for@thesmsranger.The right screenshot shows a total balance of $23,555.13 USD for@thesmsranger with a 'BOT HITS' counter.](82c2ebb7e3c8b55a525d6b91748243f4_img.jpg) The image contains two side-by-side screenshots of Telegram bot interfaces.The left screenshot has a dark purple background and shows a balance of\$9,380.65 for the bot@thesmsranger, with a link to 'View account details'.The right screenshot has a dark blue background and shows a total balance of\$23,555.13 USD for@thesmsranger, along with a 'BOT HITS' counter showing a green checkmark, a fire emoji, and a star emoji. Two screenshots of Telegram bot interfaces.The left screenshot shows a balance of\$9,380.65 for@thesmsranger.The right screenshot shows a total balance of\$23,555.13 USD for@thesmsranger with a 'BOT HITS' counter. Based on the channel, it seems that the bot allows to contact a targeted person and receive OTP, credentials, or other information: - 1 *"Use the OTP as you please"* - 2 *"Call the victim from SMSranger"* - 3 *"When prompted, send the OTP to the victim by using their card or logging account."* - 4 *"Our bot will capture the OTP when the victim types it in"* Service is available per USD 399/month, and lifetime access costs USD 1900. **Case study for this chapter.CHECKS GRUB SHOP** {33}------------------------------------------------ #### List of Prominent Groups and Channels |

Image:Icon of a person with a list

Image:Icon of a document and pencil

Image:Icon of three people

Image:Icon of a speech bubble with 'A' and '文'

| |--------------------------------------------|---------------------------------------------|------------------------------------|--------------------------------------------------------| | Name | Description | Members or Followers | Language | | The Bank ® | A channel that sells stolen credit cards | >3,940 | English | | CHECKS GRUB SHOP | A channel that sells stolen credit cards | >8,180 | English | | WhiteList | A channel that sells stolen accounts | >6,700 | English | | FraudStars | A channel that sells stolen credit cards | >9,600 | English | | BioH4zard Market | A channel for selling credit cards | >3,800 | English | | CHECKS AND SAUCE | A channel for checks | >980 | English | | The Glass House | A channel for checks | >2,300 | English | | Glass Tank Grubs | A channel for checks | >2,160 | English | | FREE GUIDES | Bank tutorials channel | >680 | English | {34}------------------------------------------------ ![Abstract background with overlapping white and light gray wavy shapes.](caf7cfcb5125b130d65c8eac5b249f8d_img.jpg) Focus #### **Ransomware & Data Extortion Groups** --- {35}------------------------------------------------ ● **Ransomware** and **data extortion** groups refer to cybercrime groups that exfiltrate confidential data from organizations and threaten to leak it, demanding from victims a ransom payment.Ransomware gangs encrypt data using ransomware, while data extortion groups don't operate this malware but only steal data.Some of these groups operate blogs where actors leak part of the data or sell it to third parties. In addition to blogs maintained by ransomware and data extortion groups, Telegram became an attractive platform for the promotion of attacks and capabilities of specific gangs.The messaging platform attracts a broader audience that has access to the leaks, compared with blogs usually located on the TOR network (some gangs have clearweb versions, but those are easier for providers to block).In terms of leaking data, Telegram allows users to upload large sets of information, which is crucial for such actors. Some groups, such as RansomHouse, maintain Telegram channels in addition to their blogs, posting there the same leaks.But this year, a few extortion groups leveraging Telegram exclusively have gained popularity following their alleged attacks against high-profile victims.Following the attacks, the threat actors published the data on their Telegram channels, attempting to force the victims to pay ransom. The most notorious groups are Lapsus\$ and Stormous, both emerging in 2021 and gaining attention in 2022.They widely used Telegram features to publicize information about their alleged attacks, creating chats for discussions, dedicated channels for leaking data of a specific victim, and polls for increasing members' activities.For example, in April, Stormous published a poll on its Telegram channel asking its subscribers to vote for the group's next target. ##### STORMOUS Ransomware Come and you will choose another target ! Victim of our team ! We will give you 5 targets you will choose 1 target and we will attack it ( denial attack\_ data hacking\_ leaking the source code of their software and their clients' data ! ) Anonymous Poll ![A horizontal bar chart showing an anonymous poll for the next target.The options are coca-cola.com (81%), mattel.com (5%), danaher.com (3%), blackboard.com (8%), and geaviation.com (3%).](9c1941fcc429d4fd6e7ad245285c5c33_img.jpg) | Target | Percentage | |----------------|------------| | coca-cola.com | 81% | | mattel.com | 5% | | danaher.com | 3% | | blackboard.com | 8% | | geaviation.com | 3% | A horizontal bar chart showing an anonymous poll for the next target.The options are coca-cola.com (81%), mattel.com (5%), danaher.com (3%), blackboard.com (8%), and geaviation.com (3%). Image:Stormous offering subscribers to vote for their next victim {36}------------------------------------------------ As opposed to one post about one victim on ransomware and data extortion blogs, such actors can send multiple messages, creating buzz around an attack.For instance, Lapsus\$ used to share screenshots of one compromised victim day by day and urge their community to discuss the leaks. ![Screenshot of a Telegram chat group named 'LAPSUS$'.The chat shows messages from January 13, 20, and 30.On Jan 13, a message says 'news coming soon' with 70.9K views.On Jan 20, a message says 'We are working in something big' with 67.3K views.On Jan 30, a message warns that only Telegram and saudegroup@ctemplar.com are contact methods, and it includes a link to a thread on raidforums.com.The background of the chat features a cartoon character and various icons.](a6a08eae7c853bf726cb40be8b3e545f_img.jpg) Screenshot of a Telegram chat group named 'LAPSUS\$'.The chat shows messages from January 13, 20, and 30.On Jan 13, a message says 'news coming soon' with 70.9K views.On Jan 20, a message says 'We are working in something big' with 67.3K views.On Jan 30, a message warns that only Telegram and saudegroup@ctemplar.com are contact methods, and it includes a link to a thread on raidforums.com.The background of the chat features a cartoon character and various icons. Image:Lapsus\$ creating tension around their activities ![Screenshot of a Telegram chat group named 'Bl00Dy Ransomware Gang'.The chat shows messages from 2022.One message says 'LEAKS LEAKS LEAKS' with 461 views at 8:41 AM.Another message says 'Be Expecting Northwoods community church leaks soon' and mentions 'nwoods.org' and 'northwoods.church' with 485 views.A third message shows a download link for 'ben.fifield creds leaks.png' (89.1 KB) and mentions 'Posting IT Admin Creds for some sites soon' by 'Ben.fifields'.](d368c9cb821b321377a38df731ecf635_img.jpg) Screenshot of a Telegram chat group named 'Bl00Dy Ransomware Gang'.The chat shows messages from 2022.One message says 'LEAKS LEAKS LEAKS' with 461 views at 8:41 AM.Another message says 'Be Expecting Northwoods community church leaks soon' and mentions 'nwoods.org' and 'northwoods.church' with 485 views.A third message shows a download link for 'ben.fifield creds leaks.png' (89.1 KB) and mentions 'Posting IT Admin Creds for some sites soon' by 'Ben.fifields'. Image:'Bl00dy Ransomware Gang', emerged in 2022, posted a few messages related to one victim It appears that less sophisticated actors mainly use Telegram.Most of them have the same rhetoric, drawing attention to themselves and communicating with followers on social media.Credibility of such groups is always questionable — for instance, for Stormous it is still largely unclear whether Stormous actually attacked most of its claimed victims.KELA observed data that was leaked on their channel being shared on cybercrime forums before. ### **Case study for this chapter:Lapsus\$** {37}------------------------------------------------ #### List of Prominent Groups and Channels | User icon

| |---------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------| | Name | Description | Subscribers | Created | | Lapsus\$ | Data extortion group | >55,800 | December 2021 | | Stormous | Data extortion group | >2,900 | April 2021 | | RansomHouse | Data extortion group | >2,000 | March 2022 | | Bl00dy Ransomware Gang | Ransomware group | >1,300 | July 2022 | | Bully | Ransomware group | >600 | September 2022 | {38}------------------------------------------------ **Focus** #### **Hacktivism** --- {39}------------------------------------------------ - The malicious use of computer technology by political or social activists to make a statement in support of their cause or ideology is referred to as **hacktivism**.Breaching a computer or a network is hacking, and defending or promoting an ideology or social view is activism; therefore, hacktivism is a combination of both.Hacktivists will oppose any entity that they believe to threaten their cause.They tend to target governments or institutions, but may also oppose corporations, religious groups, etc.Hacktivists also act to gain visibility for their cause or to send a message.Any organization may become a target, if their actions, or their government's actions, oppose the ideology of a certain hacktivist group. Telegram became widely popular among hacktivists apparently due to the same features appreciated by the financially motivated cybercriminals:the ability to communicate with large groups of people via dedicated groups and channels, and the platform's lenient moderation policies.Therefore, for hacktivists, who need to draw the attention of the audience, share illegal actions and encourage others to follow their lead, Telegram seems to be a good match. While many hacktivists have been using Telegram continually over the recent years, it seems that 2022 drove a large surge in the number of groups adopting the platform, mostly due to the Russia-Ukraine war.During the first 10 days of war, Check Point researchers noticed a sixfold increase in the number of groups concerning the conflict, with new groups created daily and some groups reaching over 250,000 users.²⁴ Ever since, both pro-Russian and pro-Ukrainian groups have been using Telegram abundantly to disclose their attacks and recruit supporters. Toward the end of the year, another geopolitical event — Iranian protests — undoubtedly strengthened the use of Telegram by the hacktivists sympathizing with the resistance movement. The most common type of posts in channels and groups managed by hacktivists, aside from general discussions and news, seems to be related to DDoS, defacement, doxing and information theft attacks that they performed. All in all, the adoption of Telegram by hacktivism groups grew significantly in 2022, continuing the trend toward popularity of the platform among such attackers.With continuing geopolitical conflicts and the hacktivists' urge to receive support from the "ordinary" internet users (for example, through donating money or helping to perform DDoS attacks using their own computers), such a trend is expected to continue in the near future. ### **Case study for this chapter:Killnet and ALtahrea Team** ²⁴ Telegram becomes a digital forefront in the Conflict {40}------------------------------------------------ #### List of Prominent Groups and Channels | Icon of a person with a list

Icon of a speech bubble with 'A' and cyrillic 'в'

| |----------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------| | Name | Description | Members or Followers | Language | | IT ARMY of Ukraine | A pro-Ukrainian volunteer movement | > 206 000 | Ukrainian | | Killnet | A pro-Russian movement performing mostly DDoS attacks | > 91 300 | Russian | | RaHDit | A pro-Russian group doxxing Ukrainian soldiers | > 69 000 | Russian | | Cyber Partisans | A Belarusian, pro-opposition movement mostly attacking Belarusian government | > 43 400 | Belarusian, Russian | | XakNet | An espionage team | > 36 500 | Russian | | Anonymous | International hacking collective | > 19 800 | English | | 1877 Team | A pro-Kurdish group performing different attacks | >17 800 | English, Arabic | | Anonymous Russia | A pro-Russian hacking group mostly performing DDoS attacks | > 12 500 | Russian | | Altahrea Team | A pro-Iranian group performing DDoS and defacement attacks | > 4900 | English, Arabic | | Phoenix | A pro-Russian group carrying out DDoS and defacement attacks | > 1300 | Russian | {41}------------------------------------------------ ![Abstract background with white wavy lines on a light gray background.](7d7d13ae39433360aef2944020c2aa73_img.jpg) Focus #### Illegal Physical Products --- {42}------------------------------------------------ #### Counterfeits of Luxury Goods Different counterfeit products are sold through various Telegram channels, groups and users, with luxury goods being a perfect example.They are openly advertised counterfeits with notes that indicate the level of quality of the forgeries.²⁵ For instance, the Telegram channel “Outlet Luxury Brands Women’s Room” sells counterfeit fashion items that copy a wide range of luxury brands, including Chanel, Dior, Balmain, Celine and Louis Vuitton.The fraudsters who operate this channel claim that their products are in “compliance of materials and other details 99.9%” compared with the original items. ![A screenshot of a Telegram post from the channel 'Outlet Luxury Brands Women's room' advertising counterfeit Dior pants.The post includes a collage of nine images showing the pants from various angles, close-ups of the waistband with the 'CHRISTIAN DIOR' label, and the waistband with a 'Dior' logo.The text in the post reads:'Outlet Luxury Brands 🛍️ Women's room', '#DIOR Pants', and a checklist:'Top version on the market from the best factory.', 'Quality - PREMIUM 1:1.Compliance of materials and other details 99.9%+.Imported materials/genuine leather', 'Complete set - case/box, checks, boot, etc.', and 'All size/different colors'.The post is attributed to '@TeamStoreRu' and shows a timestamp of 'one 19:03'.](33f3de1f0a7889fb2ab8224ad2a25029_img.jpg) Image:Telegram post advertising Dior counterfeits (automatically translated from Russian) A screenshot of a Telegram post from the channel 'Outlet Luxury Brands Women's room' advertising counterfeit Dior pants.The post includes a collage of nine images showing the pants from various angles, close-ups of the waistband with the 'CHRISTIAN DIOR' label, and the waistband with a 'Dior' logo.The text in the post reads:'Outlet Luxury Brands 🛍️ Women's room', '#DIOR Pants', and a checklist:'Top version on the market from the best factory.', 'Quality - PREMIUM 1:1.Compliance of materials and other details 99.9%+.Imported materials/genuine leather', 'Complete set - case/box, checks, boot, etc.', and 'All size/different colors'.The post is attributed to '@TeamStoreRu' and shows a timestamp of 'one 19:03'. #### COVID-19 Documents During the pandemic, a surge in COVID-19 cases all over the world fueled a black market for counterfeit coronavirus tests and vaccination certificates (both fakes and valid certificates that were issued illegally), some of which were sold at prices ranging from USD 75 to USD 600.Many Telegram groups are still selling certificates and test results, making Telegram one of the largest selling platforms.The scam level in this area is huge:some certificates are of such poor quality that they’re immediately recognized as fakes, and some sellers simply disappear once they receive payment. Thousands of people join such groups and channels:for example, “Registered Digital COVID-19 Cert,” who has more than 9,000 subscribers and was created only on July 28, 2022.The channel’s admin@DrGeorgelowe also manages “UK NHS COVID-19 Vaccine Cert,” and probably many actors in this area operate several groups dedicated to different types of products. ²⁵ See KELA’s Top Luxury Brands in France:Threat Landscape Report {43}------------------------------------------------ The admins advertise their channels by scaring people to attract more subscribers: ##### UK NHS COVID-19 Vaccine Cert It all started just one day after the biontech vaccination !!! terrible itching, sleepless nights...the dermatologist diagnosed me with "psoriasis plantaris and lichen planus".Vaccination was on July 15th., so far everything has gotten even worse...so a catastrophe I reported side effects at the Paul Ehrlich Institute. I will always be honest.Even though I'm a doctor, but I'm telling you the vaccine is no good.Contact us now and get your proof of vaccination without taking the vaccine. #### Drugs Buying drugs online is a huge market, having several advantages as opposed to buying drugs in person: - Anonymity (drugs can be bought using a pseudonym and through a secure and encryptedconnection) • Reduced risk of violence (as opposed to buying from a dealer, who might operate in a high-crime area) • Quality control (drug sellers have a reputation and reviews of their products). Generally, such services can be found on either dedicated cybercrime markets or marketplaces offering a wide range of physical goods.These platforms usually operate in the TOR network and can be hard for regular users to find and reach.Telegram, on the contrary, doesn't require any knowledge of the cybercrime ecosystem and allows users to perform the whole process in a few clicks.To search and locate relevant channels, buyers use a search bar or channels that aggregate information from sellers (for example, "Telegram Reviews"/@gangareviews).In the channel, a potential buyer selects the product that interests them, and pays for the service using cryptocurrency, contacting a support person or admin in direct messages.A downside of using Telegram for such activity is that information on sellers' reputation is scarce.The platform does not provide dedicated tools for customer reviews, and as such a buyer can only count on comments from other alleged buyers (if those are at all enabled in the channel). It is possible to find popular channels that sell drugs and that have 15,000–30,000 followers in each.Such channels gain a lot of followers quickly.For example, the ![A photograph of a hand holding a US Priority Mail box with the text 'package received' overlaid on the image.](181a45705a1f896de90f8f73c6430ba8_img.jpg) A photograph of a hand holding a US Priority Mail box with the text 'package received' overlaid on the image. Image:Drug sellers posting proofs of delivered goods {44}------------------------------------------------ “Mushrooms Doctor” channel was created only on October 28, 2022, but by the end of December it had rapidly reached more than 2,400 subscribers, most likely due to advertisements in other related channels.As for profits, a recent case involving the arrests of two drug dealers shows they made 3.7 million British pounds by selling different types of illegal drugs using Telegram.²⁶ ##### Guns Cybercrime markets are used to sell a range of weapons from around the world, including automatic assault rifles, explosives, anti-tank missiles and rocket launchers.While guns seem to be harder to sell than other products, such offers still exist on Telegram.KELA observed numerous channels where sellers post pictures of the weapons with descriptions, prices and pick-up locations such as Syria and the US, while buyers can post requests or send direct messages to negotiate prices and meet-up locations.For example, the “GUNS AND ARMS SHOP” channel was created on July 31, 2022, and has over 100,000 subscribers.The shop is located in the US, and the channel admin is@gunssadmin1, who offers for sale “top quality brand new firearms” with anonymous packaging, shipping and worldwide deliveries and claims he sells the best pistols and rifles.The price range is USD 180 to USD 6,500. ²⁶ WA Police target drug dealers using encrypted messaging apps {45}------------------------------------------------ ## **Section #3** ### **Recommendations for cybercrime researchers** --- {46}------------------------------------------------ In recent years, Telegram became a hub for various types of cybercrime activities.While there are other messaging apps favored by cybercriminals, Telegram is one of the most popular and presents a significant challenge for defenders trying to combat cybercrime on the platform.From ransomware and extortion actors to hacktivists, threat actors have widely adopted Telegram in their activities.Based on the current trend of increasing cybercrime activity on the platform, it's likely that Telegram will continue to be a popular choice for cybercriminals in 2023 and beyond.For security researchers, investigating crimes on Telegram may be difficult, because researching Telegram requires certain skills and knowledge. The app's features and design make it tough for security experts to gather evidence and hunt down offenders.The app's use of anonymity, the ability for users to establish many identities and easily switch between them, the feature that allows users to delete conversation at both sides and to set a self-destruct timer for messages, as well as the use of non-personal phone numbers make researching criminality on Telegram a difficult process.Furthermore, Telegram's enormous and active user base makes monitoring and investigating all platform activities challenging. One of the biggest difficulties for researchers in the application is that native search capabilities are limited.A search for content can only be performed within a specific community – if it is at all accessible to the user.Therefore, when researchers try to find a particular message or group, they will most likely not reach the desired result.There are various search engines created by platform users that aim to close this gap.These services crawl groups and channels and create their own databases to enable such search. Private chats that can only be accessed if a user has an invite URL, and that aren't visible in the normal search, create an additional level of difficulty.For example, a hacker offered access to Medibank for sale in a private Telegram channel that could only be accessed using an invite link.A few weeks later, Medibank suffered a cyberattack and subsequent data leak, which might have been related to the sale of said access. All of these factors make it challenging for researchers to study the behavior and activities of cybercriminals, and can hinder efforts to prevent and mitigate future cyberattacks.The difficulties of manually detecting cybercrime on Telegram emphasize the necessity for security researchers to adapt and develop new methodologies and tools for tracking and reducing cybercrime on the network.Working collaboratively with law enforcement agencies and using new technology to increase their capacity to obtain and evaluate evidence from encrypted conversations may be part of this. There are several recommendations for defenders fighting against threats emerging on Telegram and organizations researching cybercrime: - Using threat intelligence monitoring solutions to continuously monitor for potential threats on the platform and take proactive measures to prevent them - Regularly training and educating employees on how to identify and respond to cyber threats on the platform {47}------------------------------------------------ - Implementing technical controls, such as firewalls and intrusion prevention systems, to prevent cybercriminals from accessing sensitive data - Increasing collaboration and information sharing with law enforcement agencies and other organizations to improve the ability to detect and disrupt cybercrime on the platform - Conducting regular audits and assessments to identify any vulnerabilities or areas for improvement in the organization's defenses against cyber threats on the platform {48}------------------------------------------------ **Section #4** ### **Apendix 1.Case Studies** --- {49}------------------------------------------------ #### Personal and Corporate Data:**SiegedSec** For the showcase of this chapter, KELA chose an unusual channel that isn't financially motivated, as many of the aforementioned channels are.Nevertheless, the data it publishes seems to pose a serious risk. The Telegram channel "SiegedSec" was created in April 2022.Its operators share corporate, education and government-related databases.The group also defaced a large number of sites and posted proofs on its Telegram channel.While the actors haven't stated their goal, it appears that they use their Telegram channel as a platform to promote their work and show off their hacking skills.The group operating this Telegram channel is linked to the actor behind the Twitter account@YourAnonWolf.Some of the attacks claimed by SiegedSec on their Telegram channel were also publicized by@YourAnonWolf on BreachForums: ![A composite image showing two posts about a data leak.The left post is from SiegedSec on Telegram, listing 17 affected companies.The right post is from BreachForums by YourAnonWolf, showing a similar list of companies and details about the leak.](1a71c1fcfe031ac87d6458c6b5062bf1_img.jpg) **SiegedSec** A new data leak has been released! This includes databases, emails, documents, and more. Affected corps/companies/organizations: Rulmecca Corp Crane Building Company Inc. MaxPro Films McKinley Building Corporation NHC Emergency Services ACAP (NewityMarket) Alpine Resort ATS Coop (Meridian Coop) Brush Dental Care Cameron Management The Law Group The Loan Source Tribute Construction ValSource VEL CashPlease West Mark Corporation ZipQuest LEAK:[https://anonfiles.com/Z3W9j0T6x6/UWU\\_zip](https://anonfiles.com/Z3W9j0T6x6/UWU_zip) **17 databases leaked & released at once** by YourAnonWolf - Monday April 4, 2022 at 11:22 AM April 4, 2022, 11:22 AM.(This post was last modified:April 4, 2022, 11:24 AM by YourAnonWolf.) Hello! I present many databases, documents, emails, and more from many different entities. Affected corps/companies/organizations: Rulmecca Corp Crane Building Company Inc. MaxPro Films McKinley Building Corporation NHC Emergency Services ACAP (NewityMarket) Alpine Resort ATS Coop (Meridian Coop) Brush Dental Care Cameron Management The Law Group The Loan Source Tribute Construction ValSource VEL CashPlease West Mark Corporation ZipQuest Databases combined:1,666,427 lines Databases contain emails, usernames, email addresses, hashed passwords, PII, and more. 7 PDF documents retrieved from ACAP assets 2 ZIP files retrieved from ACAP assets Leaked by:SiegedSec/YourAnonWolf **Image:** A post from SiegedSec's Telegram account about the leak of 17 companies (left) and a post from BreachForums by YourAnonWolf about a data leak of the same 17 companies A composite image showing two posts about a data leak.The left post is from SiegedSec on Telegram, listing 17 affected companies.The right post is from BreachForums by YourAnonWolf, showing a similar list of companies and details about the leak. In September 2022, the group members disclosed that YourAnonWolf had stepped back from its cybercriminal activities but stated that SiegedSec would go on.The group says that they are not involved in hacktivism, but in September, they announced that they would side with Ukraine in the cyber war opposing it to Russia. {50}------------------------------------------------ #### Information Stealers:REDLINEVIP and Palm Team ##### REDLINEVIP The REDLINEVIP channel has gained popularity among threat actors in the cybercrime underground since its creation in September 2021.The owner of the channel, Rdx (@Fatherofcarders), started sharing logs also on the carding forum CrdPro in October 2021, and a month later the channel was promoted on other cybercrime forums as RaidForums and BHF.The operators of the channel started posting free logs promoting their paid private clouds.The posts on the channel included polls to understand the buyers' preferences. ![A poll titled 'REDLINEVIP Hi guys which logs you want' showing the most popular targeted country:USA at 71%, India at 22%, Russia at 15%, and Ksa at 18%.](2d62ff2bded0c21414a0f40fdf8fd537_img.jpg) **REDLINEVIP** **Hi guys which logs you want** Anonymous Poll | Country | Percentage | |---------|------------| | USA | 71% | | India | 22% | | Russia | 15% | | Ksa | 18% | image:A poll showing the most popular targeted country A poll titled 'REDLINEVIP Hi guys which logs you want' showing the most popular targeted country:USA at 71%, India at 22%, Russia at 15%, and Ksa at 18%. It seems that the channel posted credentials harvested mainly from Redline infostealer malware and their private customized stealers.Over the year, the operators have increased the prices, almost doubling the price for permanent access to the private logs cloud service, from USD 2,200 to USD 4,000. ![A screenshot of a subscription plan titled 'Subscription plans access' listing prices for Week ($200), 1 Month ($400), 2 months ($600), 3 months ($800), and Lifetime ($2200).](4134b40f9161ec8fcd3c28bdb48f80b0_img.jpg) **Subscription plans access** - Week\$200 - 1 Month\$400 - 2 months\$600 - 3 months\$800 - Lifetime\$2200 Image:A subscription plan on Oct 2021 A screenshot of a subscription plan titled 'Subscription plans access' listing prices for Week (\$200), 1 Month (\$400), 2 months (\$600), 3 months (\$800), and Lifetime (\$2200). ![A screenshot of a subscription plan titled 'REDLINEVIP Best today offer' listing prices for 3 days ($100), week ($180), month ($400), 2 month ($650), 3 month ($800), 4 month ($1150), and Lifetime ($4,000 last slot).It also mentions 'Monthly 100-200k logs' and 'private group has already 4 millions+ logs'.](5314dd284c2a98c866862ee0f0fee301_img.jpg) **REDLINEVIP** **Best today offer** - 3 days\$100 - week\$180 - month\$400 - 2 month\$650 - 3 month\$800 - 4 month\$1150 - Lifetime\$4,000 last slot Monthly 100-200k logs private group has already 4 millions+ logs @FATHEROFCARDERS Image:A subscription plan on Dec 2022 A screenshot of a subscription plan titled 'REDLINEVIP Best today offer' listing prices for 3 days (\$100), week (\$180), month (\$400), 2 month (\$650), 3 month (\$800), 4 month (\$1150), and Lifetime (\$4,000 last slot).It also mentions 'Monthly 100-200k logs' and 'private group has already 4 millions+ logs'. On December 7, 2022, the actor claimed that the private group allows access to 4 million logs.The actor detailed the benefits of being a subscriber to the private group: {51}------------------------------------------------ 1 "All logs are private and not sent on the group channel" 2 "Daily logs sent privately to every member" 3 "Cookies method" 4 "Wallet checking methods with videos" 5 "Ways to login to bank account" 6 "Limited slot only" The actor behind the REDLINEVIP Telegram channel was also operating under the moniker FATHER121 on several cybercrime forums, allowing the assessment of their credibility.There were some accusations of scamming against the actor; however, some of the accusers seem to be not reliable.The Telegram channel now has over 6,000 subscribers. They posted a minor leak of emails and IP addresses from Russian sites, more as a symbolic contribution to the cause rather than a real hacktivist effort.In November 2022, following the social protests taking place in Iran, the group decided to collaborate with GhostSec on "Operation Iran," but they once again stated that they were not hacktivists and just wanted to join "for the fun of it." ![Screenshot of a Telegram chat from 'SiegedSec' discussing a leak of emails and IP addresses from Russian sites.](ff33a4fbb84f26cd8f8935ef70fcc166_img.jpg) A screenshot of a Telegram chat group named "SiegedSec".The message from "SiegedSec" reads:"Hello siegedsec followers and feds, the members behind siegedsec are all aware of ukraines success and are happy to see the eastern terror go down.Russia always brags about their milita and how they are so 'strong' so we decided for once to actually side with anonymous (we still don't like hacktivism or anonymous) and dump multiple emails and ips from Russian sites.It's not that impressive and not to are standards but we want Russia to know they aren't invincible to us or anyone Slava Ukraini and p.s fuck the feds".Below the message are reaction icons:a red heart with the number 7 and a yellow emoji with the number 1.To the right of the message, there is a view count of 2637 and a timestamp of 2:05.Below this message is another message from "SiegedSec" containing a link:"https://anonfiles.com/60w2W292ya/emails" with a view count of 2775 and a timestamp of 2:05. Screenshot of a Telegram chat from 'SiegedSec' discussing a leak of emails and IP addresses from Russian sites. At the end of November, the group announced its retirement from hacking and leaking and disclosed the nicknames of its members. {52}------------------------------------------------ ##### Palm Team The main Telegram channel of Palm Team, a group of traffers, was created on July 1, 2022.Since then, Palm Team has also been advertised on the Russian cybercrime forum Lolz Guru.The team's admin "Luwyshka" operates on the forum under the moniker "LUWY". Palm Team operates a few different Telegram tools: 1 *"Telegram bot for traffers' applications"* 2 *"A public Telegram group for experienced traffers from the team"* 3 *"Private groups for the team"* The group also published a manual for traffic generation on the blogging platform Telegraph.Based on the owner's comments in Telegram and on Lolz Guru, their members use Raccoon and Redline stealers, but the options aren't limited to these stealers. There are several members that are in charge of different projects and are responsible for stealing credentials from specific services like games, as well as social media platforms including Amazon, Twitter and Facebook.One member is responsible for providing support and answering traffers' questions. ![Screenshot of a Telegram group chat titled 'Команда проекта TC -@LYJN4'.The chat shows a list of members including Admin (@ytagedseller),@melvin_hb (Легенда [Support]),@chinazas_exa (Отработчик гейм-логов),@speedik1337 (Отработчик Amazon/DiscordToken/Instagram/Twitter/Twitch),@maaaaaw0 (отработчик Facebook/Amazon),@false666@karik_17@masyana_LZT@aaahga - FREE SEO, and@spawns_lzt@IJustGamers1@Jeezbro - FREE ЗАЛИВ.The image is captioned 'Image:Palm Team members'.](6d9e4a73aba638d4d43a3c08dda7537c_img.jpg) A screenshot of a Telegram group chat titled "Команда проекта TC -@LYJN4".The chat shows a list of members including Admin (@ytagedseller),@melvin\_hb (Легенда [Support]),@chinazas\_exa (Отработчик гейм-логов),@speedik1337 (Отработчик Amazon/DiscordToken/Instagram/Twitter/Twitch),@maaaaaw0 (отработчик Facebook/Amazon),@false666@karik\_17@masyana\_LZT@aaahga - FREE SEO, and@spawns\_lzt@IJustGamers1@Jeezbro - FREE ЗАЛИВ.The image is captioned "Image:Palm Team members". Screenshot of a Telegram group chat titled 'Команда проекта TC -@LYJN4'.The chat shows a list of members including Admin (@ytagedseller),@melvin\_hb (Легенда [Support]),@chinazas\_exa (Отработчик гейм-логов),@speedik1337 (Отработчик Amazon/DiscordToken/Instagram/Twitter/Twitch),@maaaaaw0 (отработчик Facebook/Amazon),@false666@karik\_17@masyana\_LZT@aaahga - FREE SEO, and@spawns\_lzt@IJustGamers1@Jeezbro - FREE ЗАЛИВ.The image is captioned 'Image:Palm Team members'. Traffers are paid with a percentage of profits on the logs that they generated and that were further exploited or sold by admins.Traffers can get 80% of the revenue, and on average, for 1,000 logs, traffers would earn 10,000 Russian rubles (around USD 140).The administrators usually publish challenges and competitions to encourage users to get more logs. {53}------------------------------------------------ Forwarded from Palm Team | BOT ![Telegram logo](bc0363f46427865273bebd3bbe4dad53_img.jpg) Telegram logo DE6F19DD86298031EA9F6636...7\_07T22\_48\_06\_204285.zip 55,9 KB Новый лог! IP:154.13.1.95 (DE) Траффер:@eblanandrey OC:Windows 7 Professional x32 Данные Куков:0 Паролей:4 Карты:0 Холодные кошельки:1 ![Telegram logo](3f59cd33488f8526551967f0e5e7494c_img.jpg) Telegram logo Запросы: Пароли:[BANKS] chase.com (2) Куки:NOT FOUND 8:48 AM The owner of the group also advertised a VIP Telegram chat for Palm Team traffers.The threat actor invited experienced traffers to join the chat if they have at least 600 logs and constant traffic they can use to distribute malware. **Image:** Logs file collected by one of the traffers Мы вводим в тиму VIP чат для людей с хорошим ежедневным трафиком 🏆 Если у вас: - 600 общих логов - Регулярный трафик - Желание развиваться и увеличивать оборот - Напишите мне и я добавлю вас в VIP чат трафферов 🏆 Вы получаете: 1.Приватный чат 2.Лычку VIP в общем чате.- 3)Stealer Raccoon (по желанию) 4.Куки/Прокси для накрута + хорошие каналы 5.Перевязывание каналов.6.Ручной крипт 🏆 **Image:** Conditions for joining VIP PalmTeam chat for traffers include having at least 600 logs and regular traffic.Members receive a private chat, access to Raccoon stealer, new distribution opportunities and customized manual encryption of builds Palm Team is one of dozens of teams that monetize the collected logs obtained by traffers.These teams use Telegram as an important pillar in the distribution of malware and process of collecting logs.The platform eases the communication process between the team members, allowing them to stay under the radar.Therefore, it's reasonable that cybercriminals will continue to leverage Telegram for their operations, spreading malware and stealing corporate and private credentials. SiegedSec Today stands as a great day for all reporters companies feds and more. Siegedsecs reign of terror is over starting in February of this year we started operations with only are selves to please (get your mind out the gutter) eventually we grew a fanbase and felt like gods. We originally started with 6 and ended with 4 and all spent hours on every attack for the sake of having fun but eventually we lost the joy even though this wasn't are first time meeting each other which is what lead to this decision. We know we aren't going to be immortalized in history books as the "smartest in the world" or "best hackers ever" but to many we were a inspiration (we hope) We've decided to release are official roster as we have no problem with others larping as us or taking over as some "new order of siegedsec" but the official roster of members are as listed:mkht1 trix a12xrc and the one and only sryakarad so if these members are ever seen in siegedsec again and don't announce it trust us it's probably just some larps. We will keep the telegram up just because we are to lazy to take it down and maybe it'll be immortalized or something to be quite honest we aren't sure yet but we are sure about this As a final goodbye we have committed a attack against multiple.gov sites and for the final time fuck the feds The group's activity spanned a short period of time, and Telegram seems to offer the ease of opening a channel and the freedom to "abandon" it once it isn't needed anymore, whereas opting for using a website to dump their data would have meant going through the trouble of creating and financing a site for just a few months' use. {54}------------------------------------------------ #### Bank Fraud:CHECKS GRUB SHOP “CHECKS GRUB SHOP” is a popular group for selling credit card information, counterfeit and stolen valid checks, fullz and bank logs.The group was created on August 30, 2021, by the user called@TrippleeG.It was created as a group of the channel with the same name, allowing users to post comments in the channel and discuss posts from the channel in this group.First, only posts from the channel appeared in the group.In November 2021, other members started to join the group and offer their services.Currently the group has over 8,100 members, while the channel is inactive and has only around 300 members. A typical member of the chat would be a user periodically offering credit cards for sale, including samples, targeted countries and banks, and relevant updates: PP24 🏆 Carding supermarket 🏪 📌 Update |CC|BANKS| in shop📌 ✓ CC - seller adamantis USA Country:|AUS|BGD|BRA|CAN|IND|PAN|USA|THA|PER| Example:4842243719376527|01/23|766|Maschelle Dickerson| USA|WY|Lyman 1710 Power Avenue|3077806734| maschellemd@gmail.com|82937 ✓ BANKS - seller Goldmaster mix Big update, MIX world banks ![Bank of America Business Advantage Cash Rewards credit card for Austin S Muller, Beyond the Sea LLC.](6217eb6fdcc300d854c2ba3651151539_img.jpg) A Bank of America Business Advantage Cash Rewards credit card.The card is gold and red.It features the Bank of America logo and the text "Business Advantage Cash Rewards" and "BUSINESS CARD".The cardholder is "AUSTIN S MULLER" and the business is "BEYOND THE SEA LLC".There is a Mastercard logo in the bottom right corner. Bank of America Business Advantage Cash Rewards credit card for Austin S Muller, Beyond the Sea LLC. ![Bank of America credit card for Austin S Muller, Beyond the Sea LLC, showing card number and expiration date.](f0f533ec859d73fe7d137121f9a0fc15_img.jpg) A Bank of America credit card.The card is gold and red.It features the Bank of America logo and the text "www.bankofamerica.com" and "F852".The cardholder is "AUSTIN S MULLER" and the business is "BEYOND THE SEA LLC".The card number is "5474 1520 9889 5654".The expiration date is "11/25".There is a "Security Code" field with the number "972". Bank of America credit card for Austin S Muller, Beyond the Sea LLC, showing card number and expiration date. Channel members also advertise some items from other channels.For example, the member Redliner forwarded a message from a channel regarding a sale of logs: Redliner Reply Forwarded from cloud logs 🔥 REDLINE PRIVATE CLOUD 3.000.000 LOGS 🔥 🔥 Gaming, Bank, Crypto, Dating, Porn and much more ! MIX TARGETS 🔥 ✓ MEGA CLOUD + FREE ACCOUNTS PRO ✓ Weekly 20k-40k PCS logs ✓ Logs are fresh ✓ Geo USA, EUROPA, ASIA, MIX, Targeted ✓ Working cookies ✓ All Wallets + web Wallets ✓ Free soft search crypto wallets ( Will check the wallet.dat files ) ✓ Free Checker Logs The example illustrates how community features of Telegram helped to establish a dedicated group for banking fraudsters.First started as a discussion group meant to advertise offers of a single actor, the group attracted multiple members and eventually became more popular than the original channel. {55}------------------------------------------------ #### Ransomware and Data Extortion:Lapsus\$ Lapsus\$ emerged in early December 2021 as a data extortion group mostly targeting entities from various sectors in Brazil and Portugal.The group posted the victims on its main Telegram channel, created on December 10, 2021; as of December 2022, it had over 55,800 subscribers.Lapsus\$ also maintained a second channel; however, it only has posts starting from March 2022, and the majority were forwarded from the main channel.The group also created a chat, where they shared information from the channels regarding their victims and interacted with the chat's subscribers.Currently, the chat is not accessible, but it had over 14,000 subscribers. The group has claimed dozens of victims in countries including Brazil, Portugal, the United States, South Korea and Argentina.The victims were from the telecommunications, media and entertainment, technology, and retail industries, as well as government-related organizations.In late February and March, Lapsus\$ mostly focused on high-profile targets – Nvidia, Samsung, Microsoft and LG Electronics – and started publishing victims' data.Samsung and Nvidia reported cyberattacks around the same time the group announced them on the Telegram channel, and confirmed the content of the data leaked by Lapsus\$. Okta is one of the several big-name companies targeted by Lapsus\$.On March 22, 2022, Lapsus\$ posted screenshots on their Telegram channel claiming that they had acquired “superuser/admin” access to Okta.com.The group stated that they did not access any database and focused only on Okta's customers.One of the domains listed in the screenshots that the group uploaded was an account belonging to an engineer, who was employed at one of Okta's subcontractors.That gave Lapsus\$ access to several high-privilege Okta portals and information about the Okta clients. ![A composite image showing screenshots of Okta.com dashboards and a Telegram chat log.The chat log includes text about access to Okta.com, a note about security measures, and a link to a Telegram chat.](a57b9c2bd9e58d8969a4465b145349cb_img.jpg) Just some photos from our access to [Okta.com](#) Superuser/Admin and various other systems. For a service that powers authentication systems to many of the largest corporations (and FEDRAMP approved) I think these security measures are pretty poor. (yes we know the URL has a email address.the account is suspended - we dont care) BEFORE PEOPLE START ASKING:WE DID NOT ACCESS/STEAL ANY DATABASES FROM OKTA - our focus was ONLY on okta customers. 🤔 Btw join our chat: Image:Lapsus\$’s leaks regarding Okta attack A composite image showing screenshots of Okta.com dashboards and a Telegram chat log.The chat log includes text about access to Okta.com, a note about security measures, and a link to a Telegram chat. In March, it was reported that City of London Police arrested seven teenagers in relation to the gang and allegedly one of them is a 16-year-old from Oxford, England.Another is suspected to be a teenager residing in Brazil, according to the investigators.As of December 29, 2022, the threat actors kept silent and haven't shared information on the channel since March 30, 2022, though KELA has seen some former members being active on cybercrime forums. {56}------------------------------------------------ #### Hacktivism:Killnet and ALtahrea Team ##### Killnet Killnet has become one of the most influential of the pro-Russian hacking groups that target states opposing the country in its invasion of Ukraine.Its main Telegram channel is followed by more than 90,000 users, and its campaigns are joined by many other influential hacking groups, including XakNet and NoName057(16).This group has been targeting governmental and private entities from Ukraine and its allies since March 2022. The operation was originally founded by an actor under the moniker Killmilk in November 2021.They initially promoted their project as a botnet for DDoS attacks in January 2022, which they offered as a service for profit on cybercrime forums.In promotion posts, Killnet was described as “the first decentralized botnet” that could be used for DDoS attacks for a fee. After the start of the Russia-Ukraine war, Killnet’s activity shifted to hacktivism, and that’s when the group joined Telegram and started to build their community.Their channel was created on February 26, 2022, two days after the Russian invasion.The group not only performed and promoted DDoS attacks against pro-Ukrainian entities and states (such as Poland, Lithuania, UK, Italy, and more) but also used Telegram as a means to create a hacktivist movement called Legion.Legion consists of cyber squads that operate under different hacking teams and launch DDoS, defacement and other attacks using a similar targets list.Some of these groups eventually separated (Anonymous Russia, Phoenix, Zarya) but continued to attack the same victims and repost Killnet’s post in their own Telegram channels. Killnet usually performs a wave of attacks against targets from one country, in parallel calling in their Telegram posts for Legion squads and other groups to join their efforts.In some cases, it doesn’t only share the domain of an alleged victim, but also provides tools to perform the attack, aiming to attract as many hacktivists as possible.For example, Killnet distributed to Legion members a public script known as CC-Attack to automate the use of open proxy servers to relay attacks.These proxy servers help to preserve the anonymity of the attackers and increase the number of attacking IP addresses.The script is capable of generating three different Layer 7 attack types.The CC-Attack toolkit contains a few files and doesn’t require a skilled actor to perform an attack.²⁷ Between August and September 2022, Killmilk stepped back from Killnet activity, and a threat actor called BlackSide, who is said to be related to ransomware attacks, was named as a leader.However, per KELA’s review, Killmilk is back as the leader since mid-September 2022.The group continues to be active and is using Telegram as its main channel of communication. --- ²⁷ KillNet Utilizes CC-Attack:A Quick & Dirty DDoS Method {57}------------------------------------------------ ##### ALtahrea Team ALtahrea Team is a pro-Iranian hacktivist group whose Telegram channel was created under the handle@ALtahrea on April 19, 2022.More specifically, the group was tied to “Sabreen News,” an Iran-backed Iraqi militia outlet existing mainly as a Telegram channel (@sabreenS1) since 2020.²⁸ Following its creation, the group immediately published on this channel a countdown signifying its first cyberattacks against several Israeli media websites.Since then, the group has claimed DDoS attacks and defacements on entities from several countries, including Israel, Turkey, Saudi Arabia, Iraq, the UAE, the UK and the US.Interestingly, the group also joined the Russia-Ukraine cyber war siding with Russia.The political motivations against Israel were clearly and repeatedly stated, and for most of the rest of the targets, the actors explained what victims’ actions caused such a response. It appears that ALtahrea Team has collaborated with Team 1877, a different politically motivated group based in Iraq, which is more actively involved in the cybercriminal underground at least since 2019.Said collaborations were claimed as responsible for at least two defacement attacks, as can be seen in the Telegram posts by both teams (with Team 1877 constantly using Telegram as well). While the information regarding ALtahrea Team’s reputation is limited, the fact that ALtahrea has collaborated with 1877 Team, a reputable actor in the underground forums, may contribute to its credibility.While ALtahrea Team was active most of the year, their Telegram channel went into silence mode on October 31, suggesting that the group may have stopped their activities, at least under this handle. --- ²⁸ Profile:Sabreen News {58}------------------------------------------------ #### Monitor, Hunt and Mitigate Digital Crimes with Real Intelligence. [START NOW](#) ![KELA logo](bb199092c8621c059158cfe6707a5561_img.jpg) The logo for KELA, featuring the word "KELA" in a white, sans-serif font.To the right of the text is a red stylized icon consisting of a small dot and a curved line, resembling a bird in flight or a stylized 'e'. KELA logo The world's leader in preventing cybercrime [comment]:<> (===END_PAGE 1===) ----------------

	Report Title↓	Published Date	TLP Level	Admiralty Code	Threat Score	Created By
	[RIG] RIG Exploit Kit_ In-Depth Analysis.pdf	2023-02-27	TLP:CLEAR	ADMIRALTY:B2	78	dogesec
	KELA_Telegram_CEBIN_v4	2023-01-31	TLP:CLEAR	ADMIRALTY:B2	75	dogesec

APT_Report: cybercrime

Reports