Malware Evolution Calls for Actor Attribution?
Summary: Krebs on Security recounts how ThreatConnect traced the control server behind the Rombertik/Carbon Grabber malware sample that Cisco had publicized to a Lagos, Nigeria operator, Kayode Ogundokun, via the throwaway address genhostkay@dispostable.com and the linked kallysky@yahoo.com account. ThreatConnect assessed that Ogundokun, whose skillset it described as limited to commodity RATs and botnets, likely bought the tool from a more capable author, and Krebs argues the firms that published competing theories about the malware's disk-wiping feature never checked the attribution clues.
What you should know: ThreatConnect's point is that organizations asked to assess their exposure to Rombertik could have weighed the tool's destructive capability against a rudimentary operator's intent and reached a clearer risk judgment - work that the headline-driven writeups skipped.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026