Infostealer malware is often hidden in pirated or cracked software, and hackers then post the harvested credentials and other data online. Criminals have been infected too.

Cybersecurity researchers are increasingly unmasking or finding new information on suspected criminals from a rich and unlikely source: the tsunami of compromised credentials, browser profiles, and other system information available on Telegram. In other words, criminals are accidentally hacking themselves, perhaps by downloading cracked software laden with malware, which is then exposing their identities to researchers, and potentially law enforcement too.

In the latest example, cybersecurity firm Hudson Rock said last week it had uncovered information on Mujtaba Raza and Mohsin Raza, two alleged fraudsters on the FBI’s Most Wanted list. In April 2021, U.S. authorities charged the two men with conspiracy to produce and transfer in false identification documents, three counts of transferring false identification documents, false use of a passport, and aggravated identity theft. The men allegedly ran an illegal e-commerce business out of Karachi, Pakistan, called SecondEye Solution. This company sold digital images of fake passports, driver’s licenses, and national identity cards for more than 200 countries and territories, and the men advertised the company’s services on at least one hacker forum, according to the DOJ’s press release at the time. The DOJ said that a member of the Internet Research Agency LLC, the Russian social media and election interference organization, bought multiple fake identity documents from SecondEye.

Since those charges, Mujtaba and Mohsin have been fugitives.

Now using data from infostealers, which are a class of malware that harvest credentials and other data from an infected computer, Hudson Rock said it had identified two computers that it believes contained data related to the pair. Various pieces of infostealer malware exist, with names such as RedLine, Raccoon, Mars, BlackGuard, and Erbium. These are spread to victims by fake ExpressVPN applications, cryptocurrency wallets, or cracked or pirated software. Once the malware administrators have harvested credentials, they often sell them to other cybercriminals before posting them for free on Telegram. It’s typically here that researchers can collect the exposed credentials and then warn impacted companies. 

Included in the infostealer logs Hudson Rock found were credentials for SecondEye email accounts; cloud storage accounts linked to the same email addresses; and others for Forwarderz, another associated company.

The data harvested by the infostealers and then reviewed by Hudson Rock included much more than just passwords stored on the computers, though. Hudson Rock says it included the “entire browsing history” from one of the machines; auto-fill data, such as addresses, account numbers, and passport numbers; as well as information on when the computer was hacked, its name, and its related IP address. When one of the computers was initially infected, the malware took a screenshot. It shows a Forwarderz-branded Skype account being used, according to Hudson Rock.

Hudson Rock believes the two compromised computers don’t belong to Mujtaba and Mohsin themselves, but two other associates. Facebook and Github profiles linked to the machines, as well as a physical address included in the data, pointed to two men called Muhammad Qamber and Bakhtawar Abbas. Neither man responded to a request for comment from 404 Media.

Infostealer credentials are responsible for the recent wave of Snowflake breaches, in which hackers accessed data from a series of high profile companies, including AT&T and Ticketmaster.

Hudson Rock’s blog post says it was “reviewed and approved by the Federal Bureau of Investigation (FBI), meeting all necessary guidelines for public disclosure.” The FBI did not respond to a request for comment. Neither did Hudson Rock.

In another case, in July researchers from cybersecurity firm RecordedFuture said they found 3,324 unique credentials used to access known child abuse imagery (CSAM) websites. That data also included those peoples’ usernames, IP addresses, and system information, which could let the researchers or law enforcement unmask the users’ real identities.

RecordedFuture said it “used the data contained in infostealer logs and open-source intelligence (OSINT) to identify two individuals and found further digital artifacts, including cryptocurrency addresses, belonging to a third individual.” RecordedFuture did not respond to a request for comment. 

Whether such information would be admissible in court is a separate question, however, and would in part depend on whether law enforcement consider credentials harvested from infostealer infections to be publicly available information. The FBI did not respond to a request for comment.

Source: https://www.404media.co/criminals-keep-hacking-themselves-letting-researchers-unmask-them/