Cybercrime market sells servers for as little as US$6 to launch attacks

  • TECH
  • Thursday, 16 Jun 2016

Alarm bells: The business groups warn that all data transfer mechanisms are in jeopardy as a result of the EU ruling, something echoed by lawyers, and that could impact nearly all financial transactions between the two largest economies in the world.

FRANKFURT: A major underground marketplace acting like an eBay for criminals is selling access to more than 70,000 compromised servers allowing buyers to carry out widespread cyberattacks around the world, security experts said. 

Researchers at Kaspersky Lab, a global computer security firm based in Moscow, said the online forum appears to be run by a Russian speaking group. It offers access to hacked computers owned by governments, companies and universities in 173 countries, unbeknownst to the servers’ legitimate owners. 

Access goes for as little as US$6 (RM25) for a compromised server. Each comes pre-equipped with a variety of software to mount denial-of-service attacks on other networks, launch spam campaigns, illicitly manufacture bitcoin currency or compromise online or retail payment systems, the researchers said. 

Starting at US$7 (RM29), buyers can gain access to government servers in several countries, including interior and foreign ministries, commerce departments and several town halls, said Costin Raiu, director of Kaspersky's research and analysis team. 

He said the market might also be used to exploit hundreds of millions of old, stolen email credentials reported in recent months to be circulating in the criminal underground. 

“Stolen credentials are just one aspect of the cybercrime business,” Raiu told Reuters in an interview. “In reality, there is a lot more going on in the underground. These things are all interconnected.” 

The marketplace goes by the name xDedic. Dedic is short for dedicated, a term used in Russian online forums for a computer under remote control of a hacker and available for use by other parties. 

XDedic connects sellers of compromised servers with criminal buyers. The market's owners take a 5% up-front fee on all money put into trading accounts, Raiu said. 

Kaspersky found the machines run remote desktop software widely used by network administrators to provide technical support for Microsoft Windows users. Access to servers with high capacity network connections may cost up to US$15 (RM62). 

Low prices, searchable feature lists that advertise attack capabilities, together with services to protect illicit users from becoming detected attract buyers from entry-level cybercriminals to state-sponsored espionage groups. 

An unnamed Internet service provider in Europe alerted Kaspersky to the existence of xDedic, Raiu said. 

High-profile targets include a US aerospace firm, banks in the United States, Philippines, Kazakhstan, Jordan, Ghana, Cyprus, South Korea and Saudi Arabia, chemical firms in Singapore and Thailand and oil companies in China and the United Arab Emirates, Kaspersky found. 

Raiu declined to name the organisations. He said Kaspersky has notified national computer emergency response teams in several countries. — Reuters

Article type: metered
User Type: anonymous web
User Status:
Campaign ID: 1
Cxense type: free
User access status: 3

Did you find this article insightful?


Across The Star Online