Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:35 PM
Connect Directly

How A Pair Of Cybercriminals Scales Its Carder Business

'Vendetta Brothers' cybercrime duo runs site that offers cards stolen from over 600 banks in 41 countries, FireEye says.

A relatively small cybercrime operation specializing in the sale of stolen credit and debit cards is the latest example of the growing professionalism exhibited by many operators in the cyber underground.

Security vendor FireEye this week published a report describing the activities of two cybercriminals it has dubbed "Vendetta Brothers," who are operating a business modeled very much along the lines of legitimate organizations.

As of early this year, the duo had amassed and was selling payment cards from a total of 639 banks in 41 countries using a combination of legitimate business tactics like outsourcing and lead generation via phishing attacks.

Most of the payment card data available for sale from the Vendetta Bothers belong to users in the US and in Norway, Sweden, and Finland. FireEye’s analysis shows the two criminals are likely operating out of Spain and Eastern Europe.

What makes the Vendetta Brothers interesting is how they have managed to scale their criminal operation, says Will Glass, threat intelligence analyst at FireEye. Though just two people, the pair have shown an ability to grow and diversify their business using tactics like outsourcing and partnerships with other cybercriminals, Glass says.

“We wrote this report... because we collected enough information to raise awareness of how even small operations can adopt business-like practices to scale their operation while insulating themselves from the crimes,” he says.

The criminal duo currently operate an underground website for selling stolen credit and debit card data. It offers roughly 10,000 cards for sale, which according to FireEye, makes it relatively small compared to other carder operations.

The site offers drop-down menus for buyers of stolen card information to choose cards issued by specific banks or from specific geographic locations.

The two brothers use a couple of methods to diversify the sources for their stolen card data, FireEye says. One tactic involves partnering with cyber crooks that have already gained remote access to point-of-sale terminals at merchant locations. In these cases, the two cybercrooks supply malware for stealing card data from the already compromised POS systems.

"They place ads on underground forums looking for hackers who might already have access to point-of-sale systems but lack malware to harvest payment card data," Glass says. Another tactic they use is to look for people who might work in locations, which give them physical access to POS terminals.

Such outsourcing of the upfront legwork has offered the criminal pair an effective way to expand their reach, Glass notes. "Using recruits or cut-outs to do their dirty work for them allows them to focus on higher-level planning of their campaign while also placing distance between themselves and the actual POS compromises," he says.

On occasion, the Vendetta Brothers compromise systems on their own, sometimes using leads obtained from criminal partners. The typical strategy is to send malicious emails disguised as employment queries to targets. The emails contain attachments which when opened are designed to look for and infect POS systems.

In some cases, the duo also has used physical skimmers to capture card data and video devices to record PIN numbers.

"It is likely that other groups also use similar business-like models," Glass says. "The Vendetta Brothers have shown an enterprising nature in figuring out ways to scale their criminal schemes," in a manner that indicates thoughtful planning, he says.

Related stories:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS Build 20210202 and later Q...
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...