xorl %eax, %eax

Archive for the ‘threat intelligence’ Category

Exploitation of the Swarmshop data leak

leave a comment »

On 17 March 2021 a significant amount of data from the Swarmshop cyber-criminal marketplace were leaked online. Actually, the only threat intelligence vendor that I saw posting a quick analysis of that was Group-IB. In any case, I also had a look at this dataset and decided to write a quick blog post on how you can exploit them for threat intelligence production purposes. As always, this was a personal research project, by no means related to my employer. If you want to do something like that on a professional setting, please first check with your legal and privacy departments to avoid unpleasant surprises.

Group-IB, in their public blog post, describe Swarmshop as a mid-size “neighborhood” store for stolen personal and payment records. This is a nice description of this website which has been operating at least since April 2019 by a Russian-speaking threat actor.

However, the aim of my post is to go through the leaked data and see how could one turn them into actionable intelligence for your organization(s). So, the data leak consisted of four plaintext files with the following information:

  • 623,036 credit card details (which were sold in Swarmshop)
  • 69,592 Social Security Numbers (SSN) details (which were sold in Swarmshop)
  • 497 virtual bank accounts (which were sold in Swarmshop)
  • 12,343 Swarnshop user accounts

Let me pick each one of those leaked datasets and see how we can exploit them for intelligence purposes, starting with the smallest one, the VBAs (Virtual Bank Accounts).

VBA (Virtual Bank Accounts)

Those were online banking accounts opened by threat actors or compromised from legitimate users and put on sale in Swarmshop. The information provided in this dataset was:

  • VBA’s website
  • Username
  • Password
  • Balance
  • Account creation date

For the last field, the date implies the date the account was added to Swarmshop, not the bank account’s creation time. The following graph should give you a general idea of some insights we can deduce from this dataset. Probably the most interesting part there is that there was no VBA after October 2020 although the data breach includes data all the way until March 2021. It is also apparent that the top targets were Simple.com (41.6%), followed by Fairwinds Credit Union (17.7%) and Community First Credit Union (6.8%).

So, how can one exploit those VBAs to produce actionable intelligence? Here are a few examples:

  • If your organization is listed there, then investigate those accounts as a “known bad” with the intention to find more related accounts and better understand how they were opened (or compromised) in order to develop proactive controls that will block those TTPs in the future.
  • Use the leaked usernames to correlate them with other cyber-criminal activity such as forum accounts, credential stuffing tooling, etc. to build more complete threat actor profiles.

Credit card records

This is by far the largest dataset that was leaked with 623,036 unique records. The information available in that dataset include the following information:

  • Credit card number
  • Expiration date
  • CVV
  • Cardholder name
  • Cardholder address
  • Cardholder email (on some records)

Group-IB already published a nice graph for the geographic distribution of those records so I’m not going to repeat this. Instead, here is a breakdown per U.S. State since 62.71% of the victims were from the United States. As you can see in this heatmap, there was no U.S. State with less than 125 compromised credit cards.

It’s also worth highlighting that the top 4 States are exactly the same as with CardingMafia carding forum users, which indicates that those are probably the States with the most online activity; both as unwitting victims like in this case, and as cyber-criminals as I demonstrated in my CardingMafia post.

In general, such data are a very valuable raw intelligence with dozens of opportunities for exploitation to turn them into actionable intelligence, to give you an idea, here are a few:

  • If you are an affected organization or a national cybersecurity organization, inform the victims and the relevant banks accordingly.
  • If you own/issue credit card (virtual or physical) numbers, then check if your BIN is listed anywhere in that dataset. If it is, then immediately block those accounts, notify the victims, and do an investigation to discover the potential impact.
  • If your organization processes payments, then monitor for those credit card numbers as they are likely to be used by cyber-criminals who bought them via Swarmshop or similar cyber-criminal marketplaces.
  • The information can easily be used for pivot searching and enrichment. For example, you identified an adversary in a specific address or with a specific email address, doing a pivot search in this dataset can reveal more details that will allow you to build a higher quality threat actor profile.
  • For executive protection like what I mentioned in my other blog post

Social Security Numbers (SSN)

Then we have the SSNs records which were 69,592 unique entries but not all of them were from the United States. There were also 594 entries from Canada. Each record consisted of the following data:

  • SSN
  • Date of birth
  • Full name
  • Address
  • Phone number
  • Sex

This dataset is similar to the cardholder one in terms of raw intelligence value, but to give you a better perspective of the affected States, here’s a similar to the previous heatmap. There is an obvious insight that can be derived from that graph. That is, that the vast majority of the victims (over 68%) were from Oregon and Indiana. I didn’t spend any more time to research if there was any major SSN-targeting campaign around that time in those States, but if you know of one, then it could be related to this. That can be validated if we identify some of the victims of that campaign and do a cross-correlation with this dataset. The only State without any compromised SSN record was Vermont. The rest had anything from 6 all the way up to 23,297 compromised SSN records.

Another interesting metric that we can deduce from this dataset is the most impacted dates of birth (age). This provides an indication of ages that are more likely to become victims of cyber-criminals in the United States, mainly in Oregon and Indiana, for SSN stealing. Based on this statistical analysis it appears that the most vulnerable ages are 26-31 years old people, followed by 20-25 years old. There was no significant difference relating to their sex. In case you’re curious on the sex grouping of the victims, there were 24,462 SSNs from females, 22,354 from males and 22,182 with empty sex field values. This is resulting in 35.45% (females), 32.4% (males) and 32.15% (empty field).

Now in terms of exploitation of this dataset for actionable intelligence, it’s very very similar to the credit cards so I will not repeat the same opportunities that it provides. Instead, here are a few more that you can produce from it:

  • If you are a State-level cybersecurity organization, use the data to proactively inform and protect the victims.
  • As I hinted above, you can correlate this with known SSN-targeting campaigns in different States to link the two and thus have end-to-end visibility of the cyber-crime. From the campaign all the way to the monetization through Swarmshop, in this case.
  • Identify vulnerable groups and develop appropriate security awareness campaigns and controls.

Swarmshop accounts

At last, here are the users of this cyber-criminal marketplace. There were three different types of accounts (admin, buyer and seller) and all of the 12,343 accounts in the leaked dataset include the following information:

  • Type
  • Username
  • MD5 hashed password
  • Balance
  • (optional) email
  • Status
  • Date

In total there were 4 admin accounts, 90 seller accounts (3 of which were blocked) and 12,250 buyer accounts (22 of which were blocked and 4,296 archived). The 4 admin accounts were the following. It looks like they were recreated after a platform upgrade in early 2021.

UsernameMD5 hashed passwordBalanceemailStatusDate

There were 12 seller accounts set up with Swarmshop’s domain name which indicates that the administrator(s) of the marketplace were also selling illegal digital goods, apart from offering this platform to other sellers. And in case you wonder, yes, the leaked information can be used to de-anonymize several of those sellers and buyers of that platform but that is not something which can be shared in a public blog post.

To give you an idea how much information you can derive, here is a sample link-analysis with only a tiny bit of the information that can be discovered for the administrator (and seller) of this marketplace; who is a Russian-speaking cyber-criminal that has been involved with cyber-criminal activities at least since 2013. Apparently, I did not include anything relating to the real identity of the individual in this sample, but you can get the idea of how you can exploit that dataset for de-anonymization.

Apart from the de-anonymization of cyber-criminals, this dataset gives us insights on the growth of Swarmshop over time. In the following graph there is a clear pattern of the new buyers that were joining the platform over time. This pattern matches with certain advertisement efforts of the operators of the marketplace.

The downside of the above graph is that the amount of buyers was disproportional to the rest of the accounts so the trends of the rest are not clearly visible. So, below is a similar graph excluding the buyers.

And on how you can exploit the Swarmshop users dataset, apart from what I already demonstrated, to turn it from raw intelligence into actionable intelligence, here are some ideas to consider:

  • Use the leaked usernames, passwords, and emails to track the threat actors
  • Pivot search on the leaked passwords used to uncover more links to the threat actors
  • Identify the high-value individuals (buyers with the highest balance, admins and major sellers) and prioritize them first
  • Use the leaked usernames, passwords, and emails to enrich your investigations and provide higher-quality threat actor profiles

In conclusion, I hope that this blog post gave you more inspiration on how to turn raw intelligence from data leaks into actionable intelligence for your customers. Especially, data leaks like this one are very valuable since they provide insights on criminal organizations and as a threat intelligence analyst understanding your adversaries must be one of your top priorities. Happy to hear any more exploitation ideas for this data leak. :)

Written by xorl

May 12, 2021 at 19:17

Iran Cyber Operations Groups

with 2 comments

Unsurprisingly, after Russia, US, China, DPRK (North Korea), and EU… Here comes the mapping of the offensive cyber operations groups of Iran that have been attributed to a known government entity. Just like in the previous posts, sources and change log are available under the diagram.

If you notice anything missing, incorrect information, mistakes or anything like that please let me know to update it accordingly.

Last update: 06 May 2021



  • Version 1.0 (06 May 2021): First publication.
  • Version 1.2 (06 May 2021): Minor fixes (typos, etc.)
  • Version 1.5 (06 May 2021): Fixed a typo. Added missing “Focus” entries.

Written by xorl

May 6, 2021 at 13:00

Exploitation of data breaches for executive protection

leave a comment »

People that know me or work with me are well aware of my efforts to expand the scope of threat intelligence functions beyond the cyber domain. I have published posts, presented use cases, and have done a lot practical application of that with various organizations in both the private and public sectors. And just to be clear, I’m not a lawyer so make sure you do your due diligence, and as always, everything mentioned here is my personal views and are not related by any means with my employer.

Now one topic I’d like to cover here is how can a threat intelligence capability exploit the incredible amount of breached data that are constantly appearing to improve Executive Protection (EP). I’ll pick two examples here:

  • Facebook data breach (533 million accounts)
  • Dating & adult websites breaches (there are like a dozen in just Q1 2021)

Facebook use case

Data breaches almost always provide some information that you didn’t have before. For example, the Facebook one allows high confidence correlation of an email with a phone number and a Facebook account (at a minimum). Here are two ideas on how to exploit this for actionable EP (also sometimes called protective) intelligence:

  1. Look if details of your executives or their family members are leaked. If so, recommend them to change their phone numbers or be prepared to receive fake threats, phishing links, etc. If you implement proactive security controls on mobile phones (via some MDM solution), then you can even mark those as high risk accounts due to the discovered breached data.
  2. Use the breached data to enrich your analysis on individuals threatening your executives. For example, search if the phone number corresponds to a Facebook or email account and vice versa. Once you have a lead, build a threat actor profile and share it with the appropriate law enforcement agency along with the threat your executive received.


I had a quick look in two data sets from recent data breaches of such websites (one popular dating website and an adult content one) and identified over 3000 registered users with corporate email addresses, and even some from government email addresses. If I was a criminal or a foreign intelligence service, that would be a treasure trove. I could use that for extortion, recruitment, or any other malevolent action. Now, as a threat intelligence function we can also exploit this and here are a couple of ideas for that:

  1. If you identified such records, proactively notify the victims with a carefully crafted explanation of how those data are likely to be used in the near future for sextortion scams, blackmail, or even recruitment pitches. Recommend them to change those contact details to avoid this threat altogether recommend the use of fake personas for such websites in the future.
  2. If you identified a threat actor that was after your executives using any of those websites, then use it when building their psychological profile and exploit it as a lure to trick them into providing you more details (whether this is through elicitation or technical means).

I want to stress the fact that those two are just some examples. Each data breach provides another piece to the puzzle a person’s online life, and given enough of them you can have an incredible amount of detail which could be utilized in dozens of threat intelligence areas. Here I focused on EP but the same data are priceless for:

  • Attribution & de-anonymization
  • Threat actor profiles
  • Threat actor tracking
  • Malware analysis enrichment
  • Threat actors/groups correlation
  • Fraud investigations enrichment
  • etc.

Written by xorl

May 3, 2021 at 12:30

EU Cyber Operations Groups

leave a comment »

And after Russia, US, China and DPRK (North Korea), here is the one for APT groups associated with European Union (EU) nation-states. A big disclaimer here that I know that many more nation-states might be operating offensive cyber operations groups, but I only included those for which there has been some publicly known reporting associated with them.

If you think I got something wrong or there are more groups that I’m missing, please let me know and I’ll update the diagram as soon as possible.

Just like in the previous cases, the sources and changes log are available under the diagram.

Last update: 28 April 2021



  • Version 1.0 (28 April 2021): First publication.
  • Version 1.5 (28 April 2021): Update DGSE/STR name based on the 2012 legislation (credits: @Horgh_rce)

Written by xorl

April 28, 2021 at 16:51

North Korea (DPRK) Cyber Operations Groups

leave a comment »

After Russia, US and China, here is my mapping of known APT groups with (offensive) cyber operations capabilities from DPRK (commonly referred to as North Korea). As always, please let me know if you notice any mistakes, errors, or missing information since this is supposed to be a live document, updated as soon as new information becomes available.

The sources used are listed below the diagram, similarly to the other cases.

Last update: 28 April 2021



  • Version 1.0 (24 April 2021): First publication.
  • Version 1.5 (28 April 2021): Added Bureau 325. (credits: @SwitHak)

Written by xorl

April 24, 2021 at 13:39