The sufferer shaming web site operated by the Snatch ransomware group is leaking knowledge about its true on-line location and inside operations, in addition to the Web addresses of its guests, KrebsOnSecurity has discovered. The leaked knowledge recommend that Snatch is considered one of a number of ransomware teams utilizing paid adverts on Google.com to trick individuals into putting in malware disguised as fashionable free software program, reminiscent of Microsoft Groups, Adobe Reader, Mozilla Thunderbird, and Discord.
First noticed in 2018, the Snatch ransomware group has printed knowledge stolen from a whole lot of organizations that refused to pay a ransom demand. Snatch publishes its stolen knowledge at an internet site on the open Web, and that content material is mirrored on the Snatch workforce’s darknet web site, which is simply reachable utilizing the worldwide anonymity community Tor.
The sufferer shaming web site for the Snatch ransomware gang.
KrebsOnSecurity has discovered that Snatch’s darknet web site exposes its “server standing” web page, which incorporates details about the true Web addresses of customers accessing the web site.
Refreshing this web page each few seconds exhibits that the Snatch darknet web site generates a good quantity of visitors, typically attracting 1000’s of tourists every day. However by far probably the most frequent repeat guests are coming from Web addresses in Russia that both at present host Snatch’s clear net domains or lately did.
The Snatch ransomware gang’s sufferer shaming web site on the darknet is leaking knowledge about its guests. This “server standing” web page says that Snatch’s web site is on Central European Summer time Time (CEST) and is powered by OpenSSL/1.1.1f, which is not supported by safety updates.
Most likely probably the most energetic Web tackle accessing Snatch’s darknet web site is 193.108.114[.]41, which is a server in Yekaterinburg, Russia that hosts a number of Snatch domains, together with snatchteam[.]prime, sntech2ch[.]prime, dwhyj2[.]prime and sn76930193ch[.]prime. It may nicely be that this Web tackle is exhibiting up incessantly as a result of Snatch’s clear-web web site encompasses a toggle button on the prime that lets guests swap over to accessing the location by way of Tor.
One other Web tackle that confirmed up incessantly within the Snatch server standing web page was 194.168.175[.]226, at present assigned to Matrix Telekom in Russia. Based on DomainTools.com, this tackle additionally hosts or else lately hosted the standard coterie of Snatch domains, in addition to fairly a couple of domains phishing identified manufacturers reminiscent of Amazon and Cashapp.
The Moscow Web tackle 80.66.64[.]15 accessed the Snatch darknet web site all day lengthy, and that tackle additionally housed the suitable Snatch clear-web domains. Extra apparently, that tackle is house to a number of current domains that seem confusingly just like identified software program firms, together with libreoff1ce[.]com and www-discord[.]com.
That is attention-grabbing as a result of the phishing domains related to the Snatch ransomware gang have been all registered to the identical Russian title — Mihail Kolesnikov, a reputation that’s considerably synonymous with current phishing domains tied to malicious Google adverts.
Kolesnikov could possibly be a nod to a Russian general made well-known throughout Boris Yeltsin’s reign. Both method, it’s clearly a pseudonym, however there are another commonalities amongst these domains that will present perception into how Snatch and different ransomware teams are sourcing their victims.
DomainTools says there are greater than 1,300 present and former domains registered to Mihail Kolesnikov between 2013 and July 2023. About half of the domains seem like older web sites promoting feminine escort providers in main cities round the USA (e.g. the now-defunct pittsburghcitygirls[.]com).
The opposite half of the Kolesnikov web sites are far newer phishing domains principally ending in “.prime” and “.app” that seem designed to imitate the domains of main software program firms, together with www-citrix[.]prime, www-microsofteams[.]prime, www-fortinet[.]prime, ibreoffice[.]prime, www-docker[.]prime, www-basecamp[.]prime, ccleaner-cdn[.]prime, adobeusa[.]prime, and www.real-vnc[.]prime.
In August 2023, researchers with Trustwave Spiderlabs said they encountered domains registered to Mihail Kolesnikov getting used to disseminate the Rilide information stealer trojan.
But it surely seems a number of crime teams could also be utilizing these domains to phish individuals and disseminate every kind of information-stealing malware. In February 2023, Spamhaus warned of an enormous surge in malicious adverts that have been hijacking search ends in Google.com, and getting used to distribute at the least 5 completely different households of data stealing trojans, together with AuroraStealer, IcedID/Bokbot, Meta Stealer, RedLine Stealer and Vidar.
For instance, Spamhaus mentioned victims of those malicious adverts would seek for Microsoft Groups in Google.com, and the search engine would typically return a paid advert spoofing Microsoft or Microsoft Groups as the primary end result — above all different outcomes. The malicious advert would come with a brand for Microsoft and at first look seem like a secure and trusted place to obtain the Microsoft Groups shopper.
Nonetheless, anybody who clicked on the end result was whisked away as a substitute to mlcrosofteams-us[.]top — yet one more malicious area registered to Mr. Kolesnikov. And whereas guests to this web site might consider they’re solely downloading the Microsoft Groups shopper, the installer file features a copy of the IcedID malware, which is basically good at stealing passwords and authentication tokens from the sufferer’s net browser.
Picture: Spamhaus
The founding father of the Swiss anti-abuse web site abuse.ch informed Spamhaus it’s probably that some cybercriminals have began to promote “malvertising as a service” on the darkish net, and that there’s a substantial amount of demand for this service.
In different phrases, somebody seems to have constructed a really worthwhile enterprise churning out and selling new software-themed phishing domains and promoting that as a service to different cybercriminals. Or maybe they’re merely promoting any stolen knowledge (and any company entry) to energetic and hungry ransomware group associates.
The tip in regards to the uncovered “server standing” web page on the Snatch darkweb web site got here from @htmalgae, the identical safety researcher who alerted KrebsOnSecurity earlier this month that the darknet sufferer shaming web site run by the 8Base ransomware gang was inadvertently left in development mode.
That oversight revealed not solely the true Web tackle of the hidden 8Base web site (in Russia, naturally), but in addition the identification of a programmer in Moldova who apparently helped to develop the 8Base code.
@htmalgae mentioned the thought of a ransomware group’s sufferer shaming web site leaking knowledge that they didn’t intend to show is deliciously ironic.
“This can be a legal group that shames others for not defending consumer knowledge,” @htmalgae mentioned. “And right here they’re leaking their consumer knowledge.”
The entire malware talked about on this story is designed to run on Microsoft Home windows units. However Malwarebytes recently covered the emergence of a Mac-based info stealer trojan known as AtomicStealer that was being marketed by way of malicious Google adverts and domains that have been confusingly just like software program manufacturers.
Please be further cautious if you end up looking on-line for fashionable software program titles. Cracked, pirated copies of main software program titles are a frequent supply of infostealer infections, as are these rogue adverts masquerading as search outcomes. Be sure that to double-check you might be really on the area you consider you’re visiting *earlier than* you obtain and set up something.
Keep tuned for Half II of this submit, which features a nearer have a look at the Snatch ransomware group and their founder.
Additional studying:
@HTMalgae’s list of the top Internet addresses seen accessing Snatch’s darknet site
Ars Technica: Until Further Notice Think Twice Before Using Google to Download Software
Bleeping Computer: Hackers Abuse Google Ads to Spread Malware in Legit Software
