Void Balaur: Tracking a Cybermercenary’s Activities

Trend Micro Research presents an investigation of Void Balaur (Rockethack), a Russian-speaking cybermercenary group that offers mailbox takeovers, sells passport/flight and telco call/cell-tower data, and conducts phishing and malware campaigns targeting politicians, journalists, telco engineers, medical providers (including IVF clinics), and cryptocurrency users across many countries; the report provides infrastructure/IoC listings, malware sample details, working-hour analysis, underground marketplace activity, pricing of services, and recommended defenses.