For the previous seven years, a malware-based proxy service generally known as “Faceless” has bought anonymity to numerous cybercriminals. For lower than a greenback per day, Faceless clients can route their malicious visitors by way of tens of 1000’s of compromised programs marketed on the service. On this submit we’ll study clues left behind over the previous decade by the proprietor of Faceless, together with some that will assist put a face to the identify.
The proxy lookup web page contained in the malware-based anonymity service Faceless. Picture: spur.us.
Riley Kilmer is co-founder of Spur.us, an organization that tracks 1000’s of VPN and proxy networks, and helps clients establish visitors coming by way of these anonymity providers. Kilmer stated Faceless has emerged as one of many underground’s most dependable malware-based proxy providers, primarily as a result of its proxy community has historically included a terrific many compromised “Web of Issues” units — similar to media sharing servers — which can be seldom included on malware or spam block lists.
Kilmer stated when Spur first began trying into Faceless, they seen nearly each Web tackle that Faceless marketed for lease additionally confirmed up within the IoT search engine Shodan.io as a media sharing machine on an area community that was someway uncovered to the Web.
“We may reliably lookup the [fingerprint] for these media sharing units in Shodan and discover those self same programs on the market on Faceless,” Kilmer stated.
In January 2023, the Faceless service web site stated it was keen to pay for details about beforehand undocumented safety vulnerabilities in IoT units. These with IoT zero-days may count on cost if their exploit concerned at the very least 5,000 programs that might be recognized by way of Shodan.
Notices posted for Faceless customers, promoting an e-mail flooding service and soliciting zero-day vulnerabilities in Web of Issues units.
Not too long ago, Faceless has proven ambitions past simply promoting entry to poorly-secured IoT units. In February, Faceless re-launched a service that lets customers drop an e-mail bomb on somebody — inflicting the goal’s inbox to be full of tens of 1000’s of junk messages.
And in March 2023, Faceless began advertising a service for trying up Social Safety Numbers (SSNs) that claims to supply entry to “the most important SSN database in the marketplace with a really excessive hit fee.”
Kilmer stated Faceless needs to grow to be a one-stop-fraud-shop for cybercriminals who’re searching for stolen or artificial identities from which to transact on-line, and a short lived proxy that’s geographically near the identification being bought. Faceless presently sells this bundled product for $9 — $8 for the identification and $1 for the proxy.
“They’re making an attempt to be this one-stop store for anonymity and personas,” Kilmer stated. “The service principally says ‘right here’s an SSN and proxy connection that ought to correspond to that consumer’s location and make sense to totally different web sites.’”
MRMURZA
Faceless is a mission from MrMurza, a very talkative member of greater than a dozen Russian-language cybercrime boards over the previous decade. Based on cyber intelligence agency Flashpoint, MrMurza has been lively within the Russian underground since at the very least September 2012. Flashpoint stated MrMurza seems to be extensively concerned in botnet exercise and “drops” — fraudulent financial institution accounts created utilizing stolen identification knowledge which can be usually utilized in cash laundering and cash-out schemes.
Faceless grew out of a well-liked anonymity service known as iSocks, which was launched in 2014 and marketed on a number of Russian crime boards as a proxy service that clients may use to route their malicious Net visitors by way of compromised computer systems.
Flashpoint says that within the months earlier than iSocks went on-line, MrMurza posted on the Russian language crime discussion board Verified asking for a critical companion to help in opening a proxy service, noting that they had a botnet that was powered by malware that collected proxies with a 70 p.c an infection fee.
MrMurza’s Faceless marketed on the Russian-language cybercrime discussion board ProCrd. Picture: Darkbeast/Ke-la.com.
In September 2016, MrMurza despatched a message to all iSocks customers saying the service would quickly be phased out in favor of Faceless, and that current iSocks customers may register at Faceless at no cost in the event that they did so shortly — earlier than Faceless started charging new customers registration charges between $50 and $100.
Verified and different Russian language crime boards the place MrMurza had a presence have been hacked through the years, with contact particulars and personal messages leaked on-line. In a 2014 non-public message to the administrator of Verified explaining his bona fides, MrMurza stated he obtained years of constructive suggestions as a vendor of stolen Italian bank cards and a vendor of drops providers.
MrMurza informed the Verified admin that he used the nickname AccessApproved on a number of different boards through the years. MrMurza additionally informed the admin that his account quantity on the now-defunct digital forex Liberty Reserve was U1018928.
Based on cyber intelligence agency Intel 471, the consumer AccessApproved joined the Russian crime discussion board Zloy in Jan. 2012, from an Web tackle in Magnitogorsk, RU. In a 2012 non-public message the place AccessApproved was arguing with one other cybercriminal over a deal gone unhealthy, AccessApproved requested to be paid on the Liberty Reserve tackle U1018928.
In 2013, U.S. federal investigators seized Liberty Reserve and charged its founders with facilitating billions of {dollars} in cash laundering tied to cybercrime. The Liberty Reserve case was prosecuted out of the Southern District of New York, which in 2016 revealed an inventory of account data (PDF) tied to 1000’s of Liberty Reserve addresses the federal government asserts have been concerned in cash laundering.
That doc signifies the Liberty Reserve account claimed by MrMurza/AccessApproved — U1018928 — was assigned in 2011 to a “Vadim Panov” who used the e-mail tackle lesstroy@mgn.ru.
PANOV
Constella Intelligence, a menace intelligence agency that tracks breached databases, says lesstroy@mgn.ru was used for an account “Hackerok” on the accounting service klerk.ru that was created from an Web tackle in Magnitogorsk. The password chosen by this consumer was “1232.”
Along with promoting entry to hacked computer systems and financial institution accounts, each MrMurza and AccessApproved ran aspect hustles on the crime boards promoting clothes from widespread retailers that refused to ship on to Russia.
On one cybercrime discussion board the place AccessApproved had clothes clients, denizens of the discussion board created a prolonged dialogue thread to assist customers establish incoming emails related to numerous reshipping providers marketed inside their group. Reshippers are likely to depend on numerous folks in the US and Europe serving to to ahead packages abroad, however in lots of circumstances the notifications about purchases and delivery particulars could be forwarded to reshipping service clients from a constant e-mail account.
That thread stated AccessApproved’s clothes reshipping service forwarded affirmation emails from the tackle panov-v@mail.ru. This tackle is related to accounts on two Russian cybercrime boards registered from Magnitogorsk in 2010 utilizing the deal with “Omega^gg4u.”
This Omega^gg4u identification bought software program that may quickly examine the validity of enormous batches of stolen bank cards. Curiously, each Omega^gg4u and AccessApproved additionally had one other area of interest: Reselling closely managed substances — similar to human progress hormone and anabolic steroids — from chemical suppliers in China.
A search in Constella on the tackle panov-v@mail.ru and plenty of variations on that tackle exhibits these accounts cycled by way of the identical passwords, together with 055752403k, asus666, 01091987h, and the comparatively weak password 1232 (recall that 1232 was picked by whoever registered the lesstroy@mgn.ru account at Klerk.ru).
Constella says the e-mail tackle asus666@yandex.ru relied on the passwords asus666 and 01091987h. The 01091987h password additionally was utilized by asus666@mail.ru, which additionally favored the password 24587256.
Constella additional stories that whoever owned the a lot shorter tackle asus@mail.ru additionally used the password 24587256. As well as, it discovered the password 2318922479 was tied to each asus666@mail.ru and asus@mail.ru.
The e-mail addresses asus@mail.ru, asus2504@mail.ru, and zaxar2504@rambler.ru have been all used to register Vkontakte social media accounts for a Denis ***@VIP*** Pankov. There are a selection of different Vkontakte accounts registered to asus@mail.ru and plenty of variations of this tackle below a distinct identify. However none of these different profiles seem tied to real-life identities.
A thoughts map simplifying the analysis detailed right here.
PANKOV
Constella’s knowledge exhibits the e-mail addresses asus2504@mail.ru and zaxar2504@rambler.ru used the somewhat distinctive password denis250485, which was additionally utilized by the e-mail tackle denispankov@yandex.ru and nearly a dozen variations at different Russian-language e-mail suppliers.
Russian automobile registration data from 2016 present the e-mail tackle denispankov@yandex.ru belongs to Denis Viktorovich Pankov, born on April 25, 1985. That explains the “250485” portion of Pankov’s favored password. The registration data additional point out that in 2016 Pankov’s automobile was registered in a suburb of Moscow.
Russian incorporation data present that denispankov@yandex.com is tied to IP Pankov Denis Viktorovich, a now-defunct transportation firm within the Volograd Oblast, a area in southern Russia that shares an extended border with western Kazazkhstan.
Newer data for IP Pankov Denis Viktorovich present a microenterprise with this identify in Omsk that described its primary exercise as “retail sale by mail or through the Web.” Russian company data point out this entity was liquidated in 2021.
A reverse password search on “denis250485” through Constella exhibits this password was utilized by greater than 75 e-mail addresses, most of that are some variation of gaihnik@mail.ru — similar to gaihnik25@mail.ru, or gaihnik2504@rambler.ru.
In 2012, somebody posted solutions to a questionnaire on behalf of Denis Viktorovich Pankov to a Russian-language dialogue discussion board on Chinese language crested canine breeds. The message stated Pankov was searching for a pet of a selected breed and was a resident of Krasnogorsk, a metropolis that’s adjoining to the northwestern boundary of Moscow.
The message stated Pankov was a then 27-year-old supervisor in an promoting firm, and might be reached on the e-mail tackle gaihnik@mail.ru.
GAIHNIK
Constella Intelligence exhibits gaihnik@mail.ru registered on the now-defunct e-mail advertising service Good Responder from an tackle in Gagarin, which is about 115 miles west of Moscow.
Again in 2015, the consumer Gaihnik25 was banned from the net recreation World of Tanks for violating the sport’s phrases that prohibit “bot farming,” or the automated use of enormous numbers of participant accounts to win some benefit that’s normally associated to cashing out recreation accounts or stock.
For the previous few years, somebody utilizing the nickname Gaihnik25 has been posting messages to the Russian-language hacking discussion board Gerki[.]pw, on dialogue threads relating to software program designed to “brute drive” or mass-check on-line accounts for weak or compromised passwords.
A brand new member of the Russian hacking discussion board Nohide[.]House utilizing the deal with Gaihnik has been commenting just lately about proxy providers, credential checking software program, and the sale of hacked mailing lists. Gaihnik’s first submit on the discussion board involved non-public software program for checking World of Tanks accounts.
The tackle gaihnik@mail.ru exhibits how so many e-mail addresses tied to Pankov have been additionally related to apparently deceptive identities on Vkontakte and elsewhere. Constella discovered this tackle was tied to a Vkontakte account for a Dmitriy Zakarov.
Microsoft’s Bing search engine says gaihnik@mail.ru belongs to 37-year-old Denis Pankov, but clicking the Mail.ru profile for that consumer brings up a profile for a a lot older man by the identify Gavril Zakarov. Nonetheless, whenever you log in to a Mail.ru account and think about that profile, it exhibits that a lot of the account’s profile photographs are of a a lot youthful man.
Lots of those self same photographs present up in an on-line courting profile at courting.ru for the consumer Gaihnik, a.ok.a “Denchik,” who says he’s a 37-year-old Taurus from Gagarin who enjoys going for walks in nature, staying up late, and being on the Web.
Mr. Pankov didn’t reply to a number of requests for remark despatched to all the e-mail addresses talked about on this story. Nonetheless, a few of these addresses produced detailed error responses; Mail.ru reported that the customers panov-v@mail.ru, asus666@mail.ru, and asus2504@mail.ru have been terminated, and that gaihnik25@mail.ru is now disabled.
Messages despatched to many different e-mail addresses related through passwords to Pankov and utilizing some variation of asus####@mail.ru additionally returned related account termination messages.
