Forest Global Training Partners

Cyber Risks · Krebs on Security

Carbanak Gang Tied to Russian Security Firm?

Summary: Security researcher Ron Guilmette found that three domains documented as Carbanak crimeware distribution hubs shared WHOIS phone and fax numbers for a Xicheng Co. in China and the contact address williamdanielsen@yahoo.com, and ThreatConnect reported at least 484 domains registered to that address or 26 related emails, with at least 304 tied to a malware plugin previously attributed to Carbanak. Among the few domains on those Chinese phone numbers not seen launching malware was cubehost.biz, registered in September 2013 to Artem Tveritinov of Perm, Russia, who is also tied to the Russian security firm InfoKube and whose Vkontakte profile was deleted while Krebs was composing a follow-up email to him.

Key Takeaway: Kaspersky Lab estimates the Carbanak gang has stolen upwards of $1 billion, mostly from Russian banks, and the trail here runs through an address block whose abuse contact is info@cubehost.biz and which hosted domains Microsoft seized in 2013 as Citadel banking-malware controllers.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related