Carding Sites Turn to the ‘Dark Cloud’
Summary: A botnet dubbed the "Dark Cloud" hosts at least six stolen-credit-card shops, including Uncle Sam, Mr. Bin, Popeye and Royaldumps, by automatically changing each site's DNS address roughly every three minutes across thousands of compromised home computers. RiskAnalytics's Noah Dunker and Wayne Crowder traced more than 1,000 unique addresses in about 12 hours of scanning, with over 80 percent tied to home Internet connections in Ukraine and the rest in Russia and Romania, and said the network has operated for at least a year with signs it was running as early as summer 2014.
Bottom line: A fast-flux botnet of roughly 2,000 infected broadband endpoints in Eastern Europe is enough to keep carding shops, spam, ransomware and banking Trojans online against takedown attempts, and RiskAnalytics believes one organized crime group runs it while leasing parts to others.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026