xorl %eax, %eax

Exploitation of the Swarmshop data leak

leave a comment »

On 17 March 2021 a significant amount of data from the Swarmshop cyber-criminal marketplace were leaked online. Actually, the only threat intelligence vendor that I saw posting a quick analysis of that was Group-IB. In any case, I also had a look at this dataset and decided to write a quick blog post on how you can exploit them for threat intelligence production purposes. As always, this was a personal research project, by no means related to my employer. If you want to do something like that on a professional setting, please first check with your legal and privacy departments to avoid unpleasant surprises.

Group-IB, in their public blog post, describe Swarmshop as a mid-size “neighborhood” store for stolen personal and payment records. This is a nice description of this website which has been operating at least since April 2019 by a Russian-speaking threat actor.

However, the aim of my post is to go through the leaked data and see how could one turn them into actionable intelligence for your organization(s). So, the data leak consisted of four plaintext files with the following information:

  • 623,036 credit card details (which were sold in Swarmshop)
  • 69,592 Social Security Numbers (SSN) details (which were sold in Swarmshop)
  • 497 virtual bank accounts (which were sold in Swarmshop)
  • 12,343 Swarnshop user accounts

Let me pick each one of those leaked datasets and see how we can exploit them for intelligence purposes, starting with the smallest one, the VBAs (Virtual Bank Accounts).

VBA (Virtual Bank Accounts)

Those were online banking accounts opened by threat actors or compromised from legitimate users and put on sale in Swarmshop. The information provided in this dataset was:

  • VBA’s website
  • Username
  • Password
  • Balance
  • Account creation date

For the last field, the date implies the date the account was added to Swarmshop, not the bank account’s creation time. The following graph should give you a general idea of some insights we can deduce from this dataset. Probably the most interesting part there is that there was no VBA after October 2020 although the data breach includes data all the way until March 2021. It is also apparent that the top targets were Simple.com (41.6%), followed by Fairwinds Credit Union (17.7%) and Community First Credit Union (6.8%).

So, how can one exploit those VBAs to produce actionable intelligence? Here are a few examples:

  • If your organization is listed there, then investigate those accounts as a “known bad” with the intention to find more related accounts and better understand how they were opened (or compromised) in order to develop proactive controls that will block those TTPs in the future.
  • Use the leaked usernames to correlate them with other cyber-criminal activity such as forum accounts, credential stuffing tooling, etc. to build more complete threat actor profiles.

Credit card records

This is by far the largest dataset that was leaked with 623,036 unique records. The information available in that dataset include the following information:

  • Credit card number
  • Expiration date
  • CVV
  • Cardholder name
  • Cardholder address
  • Cardholder email (on some records)

Group-IB already published a nice graph for the geographic distribution of those records so I’m not going to repeat this. Instead, here is a breakdown per U.S. State since 62.71% of the victims were from the United States. As you can see in this heatmap, there was no U.S. State with less than 125 compromised credit cards.

It’s also worth highlighting that the top 4 States are exactly the same as with CardingMafia carding forum users, which indicates that those are probably the States with the most online activity; both as unwitting victims like in this case, and as cyber-criminals as I demonstrated in my CardingMafia post.

In general, such data are a very valuable raw intelligence with dozens of opportunities for exploitation to turn them into actionable intelligence, to give you an idea, here are a few:

  • If you are an affected organization or a national cybersecurity organization, inform the victims and the relevant banks accordingly.
  • If you own/issue credit card (virtual or physical) numbers, then check if your BIN is listed anywhere in that dataset. If it is, then immediately block those accounts, notify the victims, and do an investigation to discover the potential impact.
  • If your organization processes payments, then monitor for those credit card numbers as they are likely to be used by cyber-criminals who bought them via Swarmshop or similar cyber-criminal marketplaces.
  • The information can easily be used for pivot searching and enrichment. For example, you identified an adversary in a specific address or with a specific email address, doing a pivot search in this dataset can reveal more details that will allow you to build a higher quality threat actor profile.
  • For executive protection like what I mentioned in my other blog post

Social Security Numbers (SSN)

Then we have the SSNs records which were 69,592 unique entries but not all of them were from the United States. There were also 594 entries from Canada. Each record consisted of the following data:

  • SSN
  • Date of birth
  • Full name
  • Address
  • Phone number
  • Sex

This dataset is similar to the cardholder one in terms of raw intelligence value, but to give you a better perspective of the affected States, here’s a similar to the previous heatmap. There is an obvious insight that can be derived from that graph. That is, that the vast majority of the victims (over 68%) were from Oregon and Indiana. I didn’t spend any more time to research if there was any major SSN-targeting campaign around that time in those States, but if you know of one, then it could be related to this. That can be validated if we identify some of the victims of that campaign and do a cross-correlation with this dataset. The only State without any compromised SSN record was Vermont. The rest had anything from 6 all the way up to 23,297 compromised SSN records.

Another interesting metric that we can deduce from this dataset is the most impacted dates of birth (age). This provides an indication of ages that are more likely to become victims of cyber-criminals in the United States, mainly in Oregon and Indiana, for SSN stealing. Based on this statistical analysis it appears that the most vulnerable ages are 26-31 years old people, followed by 20-25 years old. There was no significant difference relating to their sex. In case you’re curious on the sex grouping of the victims, there were 24,462 SSNs from females, 22,354 from males and 22,182 with empty sex field values. This is resulting in 35.45% (females), 32.4% (males) and 32.15% (empty field).

Now in terms of exploitation of this dataset for actionable intelligence, it’s very very similar to the credit cards so I will not repeat the same opportunities that it provides. Instead, here are a few more that you can produce from it:

  • If you are a State-level cybersecurity organization, use the data to proactively inform and protect the victims.
  • As I hinted above, you can correlate this with known SSN-targeting campaigns in different States to link the two and thus have end-to-end visibility of the cyber-crime. From the campaign all the way to the monetization through Swarmshop, in this case.
  • Identify vulnerable groups and develop appropriate security awareness campaigns and controls.

Swarmshop accounts

At last, here are the users of this cyber-criminal marketplace. There were three different types of accounts (admin, buyer and seller) and all of the 12,343 accounts in the leaked dataset include the following information:

  • Type
  • Username
  • MD5 hashed password
  • Balance
  • (optional) email
  • Status
  • Date

In total there were 4 admin accounts, 90 seller accounts (3 of which were blocked) and 12,250 buyer accounts (22 of which were blocked and 4,296 archived). The 4 admin accounts were the following. It looks like they were recreated after a platform upgrade in early 2021.

UsernameMD5 hashed passwordBalanceemailStatusDate
admin_bossc05ac4556ee68649f90393ae0d6cdfdd0.00(empty)active2021-03-10
admin_buyerc27fb3dc3dc18dcf8d35626434f5d7c30.00bombokot@korovka.proactive2021-03-02
admin_dev1a46ece105c204fb78c60a0a0d991b280.00(empty)active2021-01-28
admin_serverf7abee2724fe075619d017adb9f037a10.00(empty)active2021-02-22

There were 12 seller accounts set up with Swarmshop’s domain name which indicates that the administrator(s) of the marketplace were also selling illegal digital goods, apart from offering this platform to other sellers. And in case you wonder, yes, the leaked information can be used to de-anonymize several of those sellers and buyers of that platform but that is not something which can be shared in a public blog post.

To give you an idea how much information you can derive, here is a sample link-analysis with only a tiny bit of the information that can be discovered for the administrator (and seller) of this marketplace; who is a Russian-speaking cyber-criminal that has been involved with cyber-criminal activities at least since 2013. Apparently, I did not include anything relating to the real identity of the individual in this sample, but you can get the idea of how you can exploit that dataset for de-anonymization.

Apart from the de-anonymization of cyber-criminals, this dataset gives us insights on the growth of Swarmshop over time. In the following graph there is a clear pattern of the new buyers that were joining the platform over time. This pattern matches with certain advertisement efforts of the operators of the marketplace.

The downside of the above graph is that the amount of buyers was disproportional to the rest of the accounts so the trends of the rest are not clearly visible. So, below is a similar graph excluding the buyers.

And on how you can exploit the Swarmshop users dataset, apart from what I already demonstrated, to turn it from raw intelligence into actionable intelligence, here are some ideas to consider:

  • Use the leaked usernames, passwords, and emails to track the threat actors
  • Pivot search on the leaked passwords used to uncover more links to the threat actors
  • Identify the high-value individuals (buyers with the highest balance, admins and major sellers) and prioritize them first
  • Use the leaked usernames, passwords, and emails to enrich your investigations and provide higher-quality threat actor profiles

In conclusion, I hope that this blog post gave you more inspiration on how to turn raw intelligence from data leaks into actionable intelligence for your customers. Especially, data leaks like this one are very valuable since they provide insights on criminal organizations and as a threat intelligence analyst understanding your adversaries must be one of your top priorities. Happy to hear any more exploitation ideas for this data leak. :)

Written by xorl

May 12, 2021 at 19:17

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s