A 26-year-old man in Ontario, Canada has been arrested for allegedly stealing information from and extorting greater than 160 firms that used the cloud information service Snowflake.
Picture: https://www.pomerium.com/weblog/the-real-lessons-from-the-snowflake-breach
On October 30, Canadian authorities arrested Alexander Moucka, a.okay.a. Connor Riley Moucka of Kitchener, Ontario, on a provisional arrest warrant from the US. Bloomberg first reported Moucka’s alleged ties to the Snowflake hacks on Monday.
On the finish of 2023, malicious hackers discovered that many massive firms had uploaded enormous volumes of delicate buyer information to Snowflake accounts that had been protected with little greater than a username and password (no multi-factor authentication required). After scouring darknet markets for stolen Snowflake account credentials, the hackers started raiding the info storage repositories utilized by among the world’s largest firms.
Amongst these was AT&T, which disclosed in July that cybercriminals had stolen private data and telephone and textual content message data for roughly 110 million individuals — practically all of its clients. Wired.com reported in July that AT&T paid a hacker $370,000 to delete stolen telephone data.
A report on the extortion assaults from the incident response agency Mandiant notes that Snowflake sufferer firms had been privately approached by the hackers, who demanded a ransom in alternate for a promise to not promote or leak the stolen information. All advised, greater than 160 Snowflake clients had been relieved of knowledge, together with TicketMaster, Lending Tree, Advance Auto Components and Neiman Marcus.
Moucka is alleged to have used the hacker handles Judische and Waifu, amongst many others. These monikers correspond to a prolific cybercriminal whose exploits had been the topic of a current story revealed right here concerning the overlap between Western, English-speaking cybercriminals and extremist teams that harass and extort minors into harming themselves or others.
On Might 2, 2024, Judische claimed on the fraud-focused Telegram channel Star Chat that they’d hacked Santander Financial institution, one of many first recognized Snowflake victims. Judische would repeat that declare in Star Chat on Might 13 — the day earlier than Santander publicly disclosed a knowledge breach — and would periodically blurt out the names of different Snowflake victims earlier than their information even went up on the market on the cybercrime boards.
404 Media experiences that at a court docket listening to in Ontario this morning, Moucka referred to as in from a jail telephone and stated he was in search of authorized support to rent an legal professional.
KrebsOnSecurity has discovered that Moucka is at the moment named in a number of indictments issued by U.S. prosecutors and federal legislation enforcement companies. Nevertheless, it’s unclear which particular expenses the indictments comprise, as all of these instances stay underneath seal.
TELECOM DOMINOES
Mandiant has attributed the Snowflake compromises to a gaggle it calls “UNC5537,” with members primarily based in North America and Turkey. Sources near the investigation inform KrebsOnSecurity the UNC5537 member in Turkey is John Erin Binns, an elusive American man indicted by the U.S. Division of Justice (DOJ) for a 2021 breach at T-Cell that uncovered the non-public data of no less than 76.6 million clients.
In a press release on Moucka’s arrest, Mandiant stated UNC5537 aka Alexander ‘Connor’ Moucka has confirmed to be one of the consequential risk actors of 2024.
“In April 2024, UNC5537 launched a marketing campaign, systematically compromising misconfigured SaaS situations throughout over 100 organizations,” wrote Austin Larsen, Mandiant’s senior risk analyst. “The operation, which left organizations reeling from important information loss and extortion makes an attempt, highlighted the alarming scale of hurt a person may cause utilizing off-the-shelf instruments.”
Sources concerned within the investigation stated UNC5537 has centered on hacking into telecommunications firms all over the world. These sources advised KrebsOnSecurity that Binns and Judische are suspected of stealing information from India’s largest state-run telecommunications agency Bharat Sanchar Nigam Ltd (BNSL), and that the duo even bragged about with the ability to intercept or divert telephone calls and textual content messages for a big portion of the inhabitants of India.
Judische seems to have outsourced the sale of databases from sufferer firms who refuse to pay, delegating a few of that work to a cybercriminal who makes use of the nickname Kiberphant0m on a number of boards. In late Might 2024, Kiberphant0m started promoting the sale of a whole bunch of gigabytes of knowledge stolen from BSNL.
“Info is price a number of million {dollars} however I’m promoting for fairly low cost,” Kiberphant0m wrote of the BSNL information in a submit on the English-language cybercrime group Breach Boards. “Negotiate a deal in Telegram.”
Additionally in Might 2024, Kiberphant0m took to the Russian-language hacking discussion board XSS to promote greater than 250 gigabytes of knowledge stolen from an unnamed cellular telecom supplier in Asia, together with a database of all energetic clients and software program permitting the sending of textual content messages to all clients.
On September 3, 2024, Kiberphant0m posted a gross sales thread on XSS titled “Promoting American Telecom Entry (100B+ Income).” Kiberphant0m’s asking value of $200,000 was apparently too excessive as a result of they reposted the gross sales thread on Breach Boards a month later, with a headline that extra clearly defined the info was stolen from Verizon‘s “push-to-talk” (PTT) clients — primarily U.S. authorities companies and first responders.
404Media reported lately that the breach doesn’t seem to influence the principle client Verizon community. Fairly, the hackers broke into a 3rd get together supplier and stole information on Verizon’s PTT programs, that are a separate product marketed in the direction of public sector companies, enterprises, and small companies to speak internally.
INTERVIEW WITH JUDISCHE
Investigators say Moucka shared a house in Kitchener with different tenants, however not his household. His mom was born in Chechnya, and he speaks Russian along with French and English. Moucka’s father died of a drug overdose at age 26, when the defendant was roughly 5 years outdated.
An individual claiming to be Judische started speaking with this creator greater than three months in the past on Sign after KrebsOnSecurity began asking round about hacker nicknames beforehand utilized by Judische over time.
Judische admitted to stealing and ransoming information from Snowflake clients, however he stated he’s not involved in promoting the knowledge, and that others have carried out this with among the information units he stole.
“I’m not likely somebody that sells information until it’s crypto [databases] or bank cards as a result of they’re the one factor I can discover consumers for that truly have cash for the info,” Judische advised KrebsOnSecurity. “The remaining is simply ransom.”
Judische has despatched this reporter dozens of unsolicited and sometimes profane messages from a number of completely different Sign accounts, all of which claimed to be an nameless tipster sharing completely different figuring out particulars for Judische. This seems to have been an elaborate effort by Judische to “detrace” his actions on-line and muddy the waters about his id.
Judische steadily claimed he had unparalleled “opsec” or operational safety, a time period that refers back to the capacity to compartmentalize and obfuscate one’s tracks on-line. In an effort to indicate he was one step forward of investigators, Judische shared data indicating somebody had given him a Mandiant researcher’s evaluation of who and the place they thought he was. Mandiant says these had been dialogue factors shared with choose reporters prematurely of the researcher’s current speak on the LabsCon safety convention.
However in a dialog with KrebsOnSecurity on October 26, Judische acknowledged it was seemingly that the authorities had been closing in on him, and stated he would significantly reply sure questions on his private life.
“They’re coming after me for certain,” he stated.
In a number of earlier conversations, Judische referenced affected by an unspecified character dysfunction, and when pressed stated he has a situation referred to as “schizotypal character dysfunction” (STPD).
In line with the Cleveland Clinic, schizotypal character dysfunction is marked by a constant sample of intense discomfort with relationships and social interactions: “Folks with STPD have uncommon ideas, speech and behaviors, which normally hinder their capacity to type and preserve relationships.”
Judische stated he was prescribed treatment for his psychological points, however that he doesn’t take his meds. Which could clarify why he by no means leaves his dwelling.
“I by no means go outdoors,” Judische allowed. “I’ve by no means had a good friend or true relationship not on-line nor in particular person. I see individuals as autos to realize my ends regardless of how pleasant I could appear on the floor, which you’ll be able to see by how briskly I discard people who find themselves loyal or [that] I’ve recognized a very long time.”
Judische later admitted he doesn’t have an official STPD prognosis from a doctor, however stated he is aware of that he displays all of the indicators of somebody with this situation.
“I can’t truly get recognized with that both,” Judische shared. “Most nations put you on lists and prohibit you from sure issues in case you have it.”
Requested whether or not he has at all times lived at his present residence, Judische replied that he needed to depart his hometown for his personal security.
“I can’t reside safely the place I’m from with out getting robbed or arrested,” he stated, with out providing extra particulars.
A supply accustomed to the investigation stated Moucka beforehand lived in Quebec, which he allegedly fled after being charged with harassing others on the social community Discord.
Judische claims to have made no less than $4 million in his Snowflake extortions. Judische stated he and others steadily focused enterprise course of outsourcing (BPO) firms, staffing companies that deal with customer support for a variety of organizations. Additionally they went after managed service suppliers (MSPs) that oversee IT help and safety for a number of firms, he claimed.
“Snowflake isn’t even the largest BPO/MSP multi-company dataset on our networks, however what’s been exfiltrated from them is effectively over 100TB,” Judische bragged. “Solely ones that don’t pay get disclosed (until they disclose it themselves). Numerous them don’t even do their SEC submitting and simply pay us to fuck off.”
INTEL SECRETS
The opposite half of UNC5537 — 24-year-old John Erin Binns — was arrested in Turkey in late Might 2024, and at the moment resides in a Turkish jail. Nevertheless, it’s unclear if Binns faces any speedy risk of extradition to the US, the place he’s at the moment needed on felony hacking expenses tied to the 2021 breach at T-Cell.
An individual accustomed to the investigation stated Binns’s utility for Turkish citizenship was inexplicably authorised after his incarceration, resulting in hypothesis that Binns could have purchased his means out of a sticky authorized state of affairs.
Beneath the Turkish structure, a Turkish citizen can’t be extradited to a overseas state. Turkey has been criticized for its “golden passport” program, which offers citizenship and sanctuary for anybody keen to pay a number of hundred thousand {dollars}.
That is a picture of a passport that Binns shared in considered one of many unsolicited emails to KrebsOnSecurity since 2021. Binns by no means defined why he despatched this in Feb. 2023.
Binns’s alleged hacker alter egos — “IRDev” and “IntelSecrets” — had been directly feared and revered on a number of cybercrime-focused Telegram communities, as a result of he was recognized to own a robust weapon: A large botnet. From reviewing the Telegram channels Binns frequented, we are able to see that others in these communities — together with Judische — closely relied on Binns and his botnet for quite a lot of cybercriminal functions.
The IntelSecrets nickname corresponds to a person who has claimed duty for modifying the supply code for the Mirai “Web of Issues” botnet to create a variant generally known as “Satori,” and supplying it to others who used it for felony achieve and had been later caught and prosecuted.
Since 2020, Binns has filed a flood of lawsuits naming varied federal legislation enforcement officers and companies — together with the FBI, the CIA, and the U.S. Particular Operations Command (PDF), demanding that the federal government flip over data collected about him and in search of restitution for his alleged kidnapping by the hands of the CIA.
Binns claims he was kidnapped in Turkey and subjected to varied types of psychological and bodily torture. In line with Binns, the U.S. Central Intelligence Company (CIA) falsely advised their counterparts in Turkey that he was a supporter or member of the Islamic State (ISIS), a declare he says led to his detention and torture by the Turkish authorities.
Nevertheless, in a 2020 lawsuit he filed in opposition to the CIA, Binns himself acknowledged having visited a beforehand ISIS-controlled space of Syria previous to transferring to Turkey in 2017.
A section of a lawsuit Binns filed in 2020 in opposition to the CIA, wherein he alleges U.S. put him on a terror watch listing after he traveled to Syria in 2017.
Sources accustomed to the investigation advised KrebsOnSecurity that Binns was so paranoid about potential surveillance on him by American and Turkish intelligence companies that his erratic habits and on-line communications truly introduced concerning the very authorities snooping that he feared.
In a number of on-line chats in late 2023 on Discord, IRDev lamented being lured right into a legislation enforcement sting operation after attempting to purchase a rocket launcher on-line. An individual near the investigation confirmed that initially of 2023, IRDev started making earnest inquiries about buy a Stinger, an American-made moveable weapon that operates as an infrared surface-to-air missile.
Sources advised KrebsOnSecurity Binns’ repeated efforts to buy the projectile earned him a number of visits from the Turkish authorities, who had been justifiably curious why he stored in search of to accumulate such a robust weapon.
WAIFU
A cautious research of Judische’s postings on Telegram and Discord since 2019 exhibits this person is extra broadly recognized underneath the nickname “Waifu,” a moniker that corresponds to one of many extra completed “SIM swappers” within the English-language cybercrime group over time.
SIM swapping includes phishing, tricking or bribing cell phone firm staff for credentials wanted to redirect a goal’s cell phone quantity to a tool the attackers management — permitting thieves to intercept incoming textual content messages and telephone calls.
A number of SIM-swapping channels on Telegram preserve a steadily up to date leaderboard of the 100 richest SIM-swappers, in addition to the hacker handles related to particular cybercrime teams (Waifu is ranked #24). That listing has lengthy included Waifu on a roster of hackers for a gaggle that referred to as itself “Beige.”
The time period “Beige Group” got here up in reporting on two tales revealed right here in 2020. The primary was in an August 2020 piece referred to as Voice Phishers Concentrating on Company VPNs, which warned that the COVID-19 epidemic had introduced a wave of focused voice phishing assaults that attempted to trick work-at-home staff into offering entry to their employers’ networks. Frequent targets of the Beige group included staff at quite a few prime U.S. banks, ISPs, and cell phone suppliers.
The second time Beige Group was talked about by sources was in reporting on a breach on the area registrar GoDaddy. In November 2020, intruders considered related to the Beige Group tricked a GoDaddy worker into putting in malicious software program, and with that entry they had been capable of redirect the net and e mail visitors for a number of cryptocurrency buying and selling platforms. Different frequent targets of the Beige group included staff at quite a few prime U.S. banks, ISPs, and cell phone suppliers.
Judische’s varied Telegram identities have lengthy claimed involvement within the 2020 GoDaddy breach, and he didn’t deny his alleged position when requested immediately. Judische stated he prefers voice phishing or “vishing” assaults that end result within the goal putting in data-stealing malware, versus tricking the person into coming into their username, password and one-time code.
“Most of my ops contain malware [because] credential entry burns too quick,” Judische defined.
CRACKDOWN ON HARM GROUPS?
The Telegram channels that the Judische/Waifu accounts frequented over time present this person divided their time between posting in channels devoted to monetary cybercrime, and harassing and stalking others in hurt communities like Leak Society and Court docket.
Each of those Telegram communities are recognized for victimizing youngsters by way of coordinated on-line campaigns of extortion, doxing, swatting and harassment. Folks affiliated with hurt teams like Court docket and Leak Society will typically recruit new members by lurking on gaming platforms, social media websites and cellular functions which can be widespread with younger individuals, together with Discord, Minecraft, Roblox, Steam, Telegram, and Twitch.
“The sort of offence normally begins with a direct message by way of gaming platforms and may transfer to extra personal chatrooms on different digital platforms, sometimes one with video enabled options, the place the dialog shortly turns into sexualized or violent,” warns a current alert from the Royal Canadian Mounted Police (RCMP) concerning the rise of sextortion teams on social media channels.
“One of many techniques being utilized by these actors is sextortion, nevertheless, they don’t seem to be utilizing it to extract cash or for sexual gratification,” the RCMP continued. “As an alternative they use it to additional manipulate and management victims to supply extra dangerous and violent content material as a part of their ideological aims and radicalization pathway.”
A number of the largest such recognized teams embrace people who go by the names 764, CVLT, Kaskar, 7997, 8884, 2992, 6996, 555, Slit City, 545, 404, NMK, 303, and H3ll.
On the assorted cybercrime-oriented channels Judische frequented, he typically lied about his or others’ involvement in varied breaches. However Judische additionally at instances shared nuggets of reality about his previous, notably when discussing the early historical past and membership of particular Telegram- and Discord-based cybercrime and hurt teams.
Judische claimed in a number of chats, together with on Leak Society and Court docket, that they had been an early member of the Atomwaffen Division (AWD), a white supremacy group whose members are suspected of getting dedicated a number of murders within the U.S. since 2017.
In 2019, KrebsOnSecurity uncovered how a loose-knit group of neo-Nazis, a few of whom had been affiliated with AWD, had doxed and/or swatted practically three dozen journalists at a variety of media publications. Swatting includes speaking a false police report of a bomb risk or hostage state of affairs and tricking authorities into sending a closely armed police response to a focused tackle.
Judsiche additionally advised a fellow denizen of Court docket that years in the past he was energetic in an older hurt group referred to as “RapeLash,” a very vile Discord server recognized for attracting Atomwaffen members. A 2018 retrospective on RapeLash posted to the now defunct neo-Nazi discussion board Fascist Forge explains that RapeLash was awash in gory, violent photographs and little one pornography.
A Fascist Forge member named “Huddy” recalled that RapeLash was the third incarnation of an extremist group also referred to as “FashWave,” brief for Fascist Wave.
“I’ve no actual data of what occurred with the middleman part generally known as ‘FashWave 2.0,’ however FashWave 3.0 homes a number of recognized Satanists and different degenerates related with AWD, considered one of which received arrested on possession of kid pornography expenses, final I heard,” Huddy shared.
In June 2024, a Mandiant worker advised Bloomberg that UNC5537 members have made demise threats in opposition to cybersecurity specialists investigating the hackers, and that in a single case the group used synthetic intelligence to create faux nude pictures of a researcher to harass them.
Allison Nixon is chief analysis officer with the New York-based cybersecurity agency Unit 221B. Nixon is amongst a number of researchers who’ve confronted harassment and particular threats of bodily violence from Judische.
Nixon stated Judische is prone to argue in court docket that his self-described psychological dysfunction(s) ought to someway excuse his lengthy profession in cybercrime and in harming others.
“They ran a misinformation marketing campaign in a sloppy try to cowl up the hacking marketing campaign,” Nixon stated of Judische. “Coverups are an acknowledgment of guilt, which is able to undermine a psychological sickness protection in court docket. We count on that violent hackers from the [cybercrime community] will expertise more and more harsh sentences because the crackdown continues.”
5:34 p.m. ET: Up to date story to incorporate a clarification from Mandiant.