{"id":47777,"date":"2022-08-12T12:15:00","date_gmt":"2022-08-12T12:15:00","guid":{"rendered":"https:\/\/cloudnewshub.com\/archives\/47777"},"modified":"2022-08-12T12:15:00","modified_gmt":"2022-08-12T12:15:00","slug":"cyber-criminal-forum-targets-only-russia","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=47777","title":{"rendered":"Cyber criminal forum targets only Russia"},"content":{"rendered":"
<\/div>\n

Researchers at Digital Shadows\u2019 Photon Research Team<\/a> have this week published information on an underground Russian language cyber criminal forum<\/a> that stands out from the crowd for a new, but not altogether surprising, reason \u2013 it explicitly targets only victims in Russia and Belarus.<\/p>\n

The Dumps Forum seems to have been established within the past three months, and, according to the Photon team, it has a small membership of around 100 individuals \u2013 it does not yet appear to vet them. Like most of its peers, it contains sections offering cyber attacks as a service, data leaks, illicit materials, carding support, malware and access to compromised networks.<\/p>\n

But unlike its peers, that Dumps\u2019 actual goal is to support the Ukrainian war effort is made abundantly clear from the get-go; its mission statement translates as: \u201cInformation services\/leaks or other services on our forum are allowed in relation to only two states, these are the Russian Federation and Belarus. Topics that mention other countries are not allowed. This is the main rule of our forum.\u201d<\/p>\n

This intent is also expressed redirect links to information on the ongoing conflict in Ukraine, and Ukrainian and pro-Ukraine charity organisations.<\/p>\n

The Photon team said that while Russia\u2019s invasion of Ukraine has been condemned around the world, the conflict has proven very divisive in the cyber criminal community<\/a> \u2013 which is, of course, heavily influenced by Russian actors.<\/p>\n

\u201cOpinions on Russian president Vladimir Putin\u2019s so-called \u2018special military operation\u2019 depend on several factors, notably the cyber criminal\u2019s background, political beliefs or other nationalistic drivers,\u201d they wrote<\/a>.<\/p>\n

\u201cAs we\u2019ve reported in previous blogs, some internet users have taken it on themselves to take an active role in the conflict<\/a>, targeting Russian organisations with targeted data breaches, distributed denial of service [DDoS] attacks and defacement activity.\u201d<\/p>\n

However, they went on, Dumps appears to be the only cyber criminal forum to have adopted a pro-Ukraine stance. \u201c[This] puts Dumps Forum in a unique position, whilst also painting a target on its own back; if the forum develops into a well-known and successful project, it will likely become a target of counter activity from Russia-supporting cyber criminals,\u201d the Photon researchers added.<\/p>\n

\u201cThe brazen nature of the forum is perhaps best emphasised by the forum administrator actually posting their location, which points to a residential apartment in Kyiv. The roof of the building contains an insult towards Vladimir Putin.<\/p>\n

\u201cWe\u2019ve no idea if this location is actually the admin\u2019s home, however it emphasises the spirit of defiance and resistance in which the forum is built.\u201d<\/p>\n

The researchers said that the forum\u2019s rules state all topics must be aimed towards anti-Russian or Belarussian activity, and much of what is going on within its confines relates to sharing leaked data, advertising DDoS attacks, forged and stolen ID documents, and \u2018bulletproof\u2019 hosting services. Some sections of the forum, such as those relating to carding or initial access brokers [IABs], are in fact devoid of activity.<\/p>\n

By some margin, the largest active section of Dumps is devoted to leaked data stolen from Russian government bodies and private sector companies, including a number of utilities providers.<\/p>\n

Dumps\u2019 DDoS-as-a-service section, meanwhile, enables users to call in a DDoS attack on any network resource, starting at $80 for an hour-long bombardment or $500 for 24 hours at Layer 4, with up to 500Gbps of firepower. A Layer 7 DDoS attack runs about $100 more expensive.<\/p>\n

The third most active section, referred to as \u2018probiv\u2019 (a Russian slang term that loosely translates as \u2018look-up\u2019) which is aimed at advertising information services where cyber criminals can find information on their potential targets, for a price. Some of the items currently available include Russian passport information, criminal records including convictions for possessing illegal weapons, and information related to people buying tickets to leave Russia.<\/p>\n

The Photon Team postulated that this might suggest that Dumps\u2019 admins and users are particularly interested in Russian citizens sympathetic to Ukraine\u2019s cause, some of whom may be inclined to attempt to travel to Ukraine to act as mercenaries or partisans. One may also infer this from the fact that the forum content is almost entirely written in Russian (which many Ukrainians speak) and not Ukrainian (which most Russians do not). Dumps claims, incidentally, to be blocked in Russia.<\/p>\n

The Photon team said Dumps was likely still trying to establish itself, hence it remains relatively easy to find and join, although this presents an operational security risk to its admins should it become too well-known, particularly in the pro-Russian underground.<\/p>\n

\u201cDumps Forum likely has an important role to play in the ongoing Russia-Ukraine war; as a hub for hacktivists and patriotic cyber threat actors, as a symbol of resistance, and making a demonstrable difference on the cyber battlefield,\u201d they said.<\/p>\n

\u201cAny success achieved by Dumps Forum will however attract unwanted attention. The ban on Russian citizens visiting the forum highlights that the forum is already on the radar of the Russian state. It is also realistically possible that the success of Dumps Forum may inspire other services looking to play a part in the ongoing conflict.\u201d <\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers at Digital Shadows\u2019 Photon Research Team have this week published information on an underground Russian language cyber criminal forum that stands out from the crowd for a new, but not altogether surprising, reason \u2013 it explicitly targets only victims in Russia and Belarus. The Dumps Forum seems to have been established within the past […]<\/p>\n","protected":false},"author":1,"featured_media":47778,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[533],"tags":[],"class_list":["post-47777","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it"],"_links":{"self":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/47777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=47777"}],"version-history":[{"count":0,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/47777\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/media\/47778"}],"wp:attachment":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=47777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=47777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=47777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}