Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:35 PM
Connect Directly

How A Pair Of Cybercriminals Scales Its Carder Business

'Vendetta Brothers' cybercrime duo runs site that offers cards stolen from over 600 banks in 41 countries, FireEye says.

A relatively small cybercrime operation specializing in the sale of stolen credit and debit cards is the latest example of the growing professionalism exhibited by many operators in the cyber underground.

Security vendor FireEye this week published a report describing the activities of two cybercriminals it has dubbed "Vendetta Brothers," who are operating a business modeled very much along the lines of legitimate organizations.

As of early this year, the duo had amassed and was selling payment cards from a total of 639 banks in 41 countries using a combination of legitimate business tactics like outsourcing and lead generation via phishing attacks.

Most of the payment card data available for sale from the Vendetta Bothers belong to users in the US and in Norway, Sweden, and Finland. FireEye’s analysis shows the two criminals are likely operating out of Spain and Eastern Europe.

What makes the Vendetta Brothers interesting is how they have managed to scale their criminal operation, says Will Glass, threat intelligence analyst at FireEye. Though just two people, the pair have shown an ability to grow and diversify their business using tactics like outsourcing and partnerships with other cybercriminals, Glass says.

“We wrote this report... because we collected enough information to raise awareness of how even small operations can adopt business-like practices to scale their operation while insulating themselves from the crimes,” he says.

The criminal duo currently operate an underground website for selling stolen credit and debit card data. It offers roughly 10,000 cards for sale, which according to FireEye, makes it relatively small compared to other carder operations.

The site offers drop-down menus for buyers of stolen card information to choose cards issued by specific banks or from specific geographic locations.

The two brothers use a couple of methods to diversify the sources for their stolen card data, FireEye says. One tactic involves partnering with cyber crooks that have already gained remote access to point-of-sale terminals at merchant locations. In these cases, the two cybercrooks supply malware for stealing card data from the already compromised POS systems.

"They place ads on underground forums looking for hackers who might already have access to point-of-sale systems but lack malware to harvest payment card data," Glass says. Another tactic they use is to look for people who might work in locations, which give them physical access to POS terminals.

Such outsourcing of the upfront legwork has offered the criminal pair an effective way to expand their reach, Glass notes. "Using recruits or cut-outs to do their dirty work for them allows them to focus on higher-level planning of their campaign while also placing distance between themselves and the actual POS compromises," he says.

On occasion, the Vendetta Brothers compromise systems on their own, sometimes using leads obtained from criminal partners. The typical strategy is to send malicious emails disguised as employment queries to targets. The emails contain attachments which when opened are designed to look for and infect POS systems.

In some cases, the duo also has used physical skimmers to capture card data and video devices to record PIN numbers.

"It is likely that other groups also use similar business-like models," Glass says. "The Vendetta Brothers have shown an enterprising nature in figuring out ways to scale their criminal schemes," in a manner that indicates thoughtful planning, he says.

Related stories:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-09-16
IBM Sterling File Gateway through is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.