Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:35 PM
Connect Directly

How A Pair Of Cybercriminals Scales Its Carder Business

'Vendetta Brothers' cybercrime duo runs site that offers cards stolen from over 600 banks in 41 countries, FireEye says.

A relatively small cybercrime operation specializing in the sale of stolen credit and debit cards is the latest example of the growing professionalism exhibited by many operators in the cyber underground.

Security vendor FireEye this week published a report describing the activities of two cybercriminals it has dubbed "Vendetta Brothers," who are operating a business modeled very much along the lines of legitimate organizations.

As of early this year, the duo had amassed and was selling payment cards from a total of 639 banks in 41 countries using a combination of legitimate business tactics like outsourcing and lead generation via phishing attacks.

Most of the payment card data available for sale from the Vendetta Bothers belong to users in the US and in Norway, Sweden, and Finland. FireEye’s analysis shows the two criminals are likely operating out of Spain and Eastern Europe.

What makes the Vendetta Brothers interesting is how they have managed to scale their criminal operation, says Will Glass, threat intelligence analyst at FireEye. Though just two people, the pair have shown an ability to grow and diversify their business using tactics like outsourcing and partnerships with other cybercriminals, Glass says.

“We wrote this report... because we collected enough information to raise awareness of how even small operations can adopt business-like practices to scale their operation while insulating themselves from the crimes,” he says.

The criminal duo currently operate an underground website for selling stolen credit and debit card data. It offers roughly 10,000 cards for sale, which according to FireEye, makes it relatively small compared to other carder operations.

The site offers drop-down menus for buyers of stolen card information to choose cards issued by specific banks or from specific geographic locations.

The two brothers use a couple of methods to diversify the sources for their stolen card data, FireEye says. One tactic involves partnering with cyber crooks that have already gained remote access to point-of-sale terminals at merchant locations. In these cases, the two cybercrooks supply malware for stealing card data from the already compromised POS systems.

"They place ads on underground forums looking for hackers who might already have access to point-of-sale systems but lack malware to harvest payment card data," Glass says. Another tactic they use is to look for people who might work in locations, which give them physical access to POS terminals.

Such outsourcing of the upfront legwork has offered the criminal pair an effective way to expand their reach, Glass notes. "Using recruits or cut-outs to do their dirty work for them allows them to focus on higher-level planning of their campaign while also placing distance between themselves and the actual POS compromises," he says.

On occasion, the Vendetta Brothers compromise systems on their own, sometimes using leads obtained from criminal partners. The typical strategy is to send malicious emails disguised as employment queries to targets. The emails contain attachments which when opened are designed to look for and infect POS systems.

In some cases, the duo also has used physical skimmers to capture card data and video devices to record PIN numbers.

"It is likely that other groups also use similar business-like models," Glass says. "The Vendetta Brothers have shown an enterprising nature in figuring out ways to scale their criminal schemes," in a manner that indicates thoughtful planning, he says.

Related stories:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
PUBLISHED: 2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
PUBLISHED: 2020-08-08
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
PUBLISHED: 2020-08-08
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.