IntelBroker | |
|---|---|
 The profile picture commonly used by IntelBroker | |
| Nationality | Serbian |
| Known for | Hacking several government agencies and corporations |
IntelBroker is a Serbian black hat hacker active since October 2022, who has committed several high-profile cyber attacks. Their targets have included Europol, Pandabuy, and Apple, with over 80 sales and leaks of compromised data having been traced to them. They claim to be currently residing in Russia for security reasons.
IntelBroker first began activities in October 2022, hacking minor organizations, but only gained notoriety in 2023 after an attack on the food delivery service "Weee!". [1] [2] After their initial string of attacks, they were speculated to be a highly skilled team, possibly an Iranian Persistent Threat Group, however an interview with The Cyber Express revealed that they were a single person. In the same interview they revealed several personal details, such as that they are Serbian, and that they currently live in Russia for safety reasons. [3] IntelBroker often contributes to the racist hacking group CyberNiggers, [2] and in August 2024 became the owner of the cybercrime forum BreachForums. [4] As of June 2024, they had posted over 80 separate leaks and sales of compromised information on BreachForums, with IntelBroker claiming that they had sold the information of over 400 organizations. [3]
IntelBroker has used a wide range of tactics to enter secured systems, such as exploiting leaked credentials and exploiting organizations public facing applications. Once inside, they remain for an extended period of time, escalating privileges and acquiring data. Finally, they ransom, sell, or leak the data, often on BreachForums. [5] [3]
IntelBroker created a unique ransomware strain written in C# known as Endurance, and published its source code publicly on their GitHub page. While labeled as ransomware, the software overwrites and then deletes all targeted files. [5] Endurance was confirmed by the Department of Defense Cyber Crime Center to have been used by IntelBroker to hack several U.S. government agencies. [6] They speculated that Endurance was related to the Shamoon wiping software sometimes used by Iranian Hackers, which IntelBroker has denied. [3]
In April 2024, IntelBroker announced that they and the black hat hacker Sanggiero had hacked Acuity, a technology contractor for the U.S. government, and subsequently obtained confidential information belonging to the Five Eyes intelligence organization and the United States military. A vast majority of the information had been stored in a GitHub repository by Acuity, which IntelBroker was able to access. [7] [8] The information included confidential communications and documents between Five Eyes members, and the contact information for several U.S. government and military officials. [9] Sanggiero claimed that the breach had taken place on March 7, a month before the information was leaked. [10] After an investigation, Acuity determined that the leaked data was old and non-sensitive. [11]
On March 31, 2024, IntelBroker assisted Sangierro in a hack of the Chinese e-commerce website Pandabuy, with user data sold the database on BreachForum for a small "symbolic" bitcoin payment. [12] [13] The information had been initially ransomed to Pandabuy for an unknown amount of money, but after it was paid the leak was still released. [14] [15] IntelBroker and Sangierro claimed that the leak contained the names, contact details, orders, and addresses of over 3 millions Pandabuy customers, while an analysis by "Have I Been Pwned?" creator Troy Hunt found that only approximately 1.3 million user entries were real, while the rest contained fake email addresses. [13] [16] Pandabuy attempted to censor posts on its Discord and Reddit pages to cover up the leak, before offering a "10% freight subsidy" to users as compensation. Both actions were received negatively by Pandabuy customers. [17] [18]
On June 3, 2024, Sanggiero posted on BreachForums that they were going to sell all information from the databreach, containing over 17 million user entries, for $40,000. They had again ransomed the information to Pandabuy, who refused to pay as the two had violated the original ransom and sold the information. [14] [15]
On May 10, 2024, IntelBroker announced on BreachForums that they had gained access to 9,128 confidential records from the European Union's law enforcement agency Europol, including employee information, source code, and guideline documents. Most of the records came from the Europol Platform for Experts, a discussion platform for law enforcement, and the electronic evidence program SIRIUS. Europol confirmed that the leak was real, but claimed that it only contained information from Europol Platform for Experts and SIRIUS, and did not contain any operational information. [19] [20] IntelBroker announced that they would be accepting offers for the data in Monero, [21] which was sold on May 11. [22]
In June 2024, IntelBroker claimed on X that they had acquired source code for several internal Apple tools, before releasing the code on BreachForums. These tools were related to internal Apple processes, such as authenticating users and sharing information within Apple's network. [23] Later analysis revealed that leaked code was not source code, but instead plugins for internal tools. However, the code still was a security risk, and could potentially be used by malicious parties. [24] [25]
On June 17, 2024, IntelBroker claimed on BreachForums that they had breached semi-conductor giant AMD, and was selling the compromised data. Samples provided by them included data on future products, employee information, customer information, source code, and financial records. [26] AMD quickly contacted law enforcement agencies to investigate the breach. [27] Soon after AMD claimed that the breach was limited in scope, would not impact the business, and implied that it did not include employee or customer information, conflicting with the initial report by The Cyber Express. [28] Bloomberg correlated the attack with a 2.4% fall in AMD stock soon after the breach was announced. [29]
An internet leak is the unauthorized release of information over the internet. Various types of information and data can be, and have been, "leaked" to the Internet, the most common being personal information, computer software and source code, and artistic works such as books or albums. For example, a musical album is leaked if it has been made available to the public on the Internet before its official release date.
The Internet has a long history of turbulent relations, major maliciously designed disruptions, and other conflicts. This is a list of known and documented Internet, Usenet, virtual community and World Wide Web related conflicts, and of conflicts that touch on both offline and online worlds with possibly wider reaching implications.
Cyberwarfare by China is the aggregate of cyberattacks attributed to the organs of the People's Republic of China and various related advanced persistent threat (APT) groups.
Vault 7 is a series of documents that WikiLeaks began to publish on 7 March 2017, detailing the activities and capabilities of the United States Central Intelligence Agency (CIA) to perform electronic surveillance and cyber warfare. The files, dating from 2013 to 2016, include details on the agency's software capabilities, such as the ability to compromise cars, smart TVs, web browsers including Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera, the operating systems of most smartphones including Apple's iOS and Google's Android, and computer operating systems including Microsoft Windows, macOS, and Linux. A CIA internal audit identified 91 malware tools out of more than 500 tools in use in 2016 being compromised by the release. The tools were developed by the Operations Support Branch of the CIA.
Hack Forums is an Internet forum dedicated to discussions related to hacker culture and computer security. The website ranks as the number one website in the "Hacking" category in terms of web-traffic by the analysis company Alexa Internet. The website has been widely reported as facilitating online criminal activity, such as the case of Zachary Shames, who was arrested for selling keylogging software on Hack Forums in 2013 which was used to steal personal information.
REvil was a Russia-based or Russian-speaking private ransomware-as-a-service (RaaS) operation. After an attack, REvil would threaten to publish the information on their page Happy Blog unless the ransom was received. In a high profile case, REvil attacked a supplier of the tech giant Apple and stole confidential schematics of their upcoming products. In January 2022, the Russian Federal Security Service said they had dismantled REvil and charged several of its members.
ShinyHunters is a black-hat criminal hacker group that is believed to have formed in 2020 and is said to have been involved in numerous data breaches. The stolen information is often sold on the dark web.
A global wave of cyberattacks and data breaches began in January 2021 after four zero-day exploits were discovered in on-premises Microsoft Exchange Servers, giving attackers full access to user emails and passwords on affected servers, administrator privileges on the server, and access to connected devices on the same network. Attackers typically install a backdoor that allows the attacker full access to impacted servers even if the server is later updated to no longer be vulnerable to the original exploits. As of 9 March 2021, it was estimated that 250,000 servers fell victim to the attacks, including servers belonging to around 30,000 organizations in the United States, 7,000 servers in the United Kingdom, as well as the European Banking Authority, the Norwegian Parliament, and Chile's Commission for the Financial Market (CMF).
On 14 May 2021, the Health Service Executive (HSE) of Ireland suffered a major ransomware cyberattack which caused all of its IT systems nationwide to be shut down.
Lapsus$, stylised as LAPSUS$ and classified by Microsoft as Strawberry Tempest, is an international extortion-focused hacker group known for its various cyberattacks against companies and government agencies. The group was active in several countries, and has had its members arrested in Brazil and the UK in 2022. According to City of London Police at least two of the members were teenagers.
MangaDex is a nonprofit website that aggregates translations of manga, manhwa, and manhua. Content on the website is usually unofficial, uploaded by "scanlation" groups, but links to official services like Manga Plus and Bilibili Comics are also provided on the website. MangaDex was started in 2018 by developer Hologfx, and is funded through user donations and affiliate programs. The website is blocked in several countries, including Italy and Russia.
BreachForums, sometimes referred to as Breached, is an English-language black hat–hacking crime forum. The website acted as an alternative and successor to RaidForums following its shutdown and seizure in 2022. Like its predecessor, BreachForums allows for the discussion of various hacking topics and distributed data breaches, pornography, hacking tools and various other services.
Hive was a ransomware as a service (RaaS) operation carried out by the eponymous cybercrime organization between June 2021 and January 2023. The group's purpose was to attack mainly public institutions to subsequently demand ransom for release of hijacked data.
Clop is a cybercriminal organization known for its multilevel extortion techniques and global malware distribution. It has extorted more than $500 million in ransom payments, targeting major organizations worldwide. Clop gained notoriety in 2019 and has since conducted high-profile attacks, using large-scale phishing campaigns and sophisticated malware to infiltrate networks and demand ransom, threatening to expose data if demands are not met.
LockBit is a cybercriminal group proposing ransomware as a service (RaaS). Software developed by the group enables malicious actors who are willing to pay for using it to carry out attacks in two tactics where they not only encrypt the victim's data and demand payment of a ransom, but also threaten to leak it publicly if their demands are not met.
BlackCat, also known as ALPHV and Noberus, is a ransomware family written in Rust. It made its first appearance in November 2021. By extension, it is also the name of the threat actor(s) who exploit it.
SiegedSec, short for Sieged Security and commonly self-described as the "Gay Furry Hackers", was a black-hat criminal hacktivist group, that was formed in early 2022, that committed a number of high profile cyber attacks, including attacks on NATO, Idaho National Laboratory, and Real America's Voice. On July 10, 2024, after attacking The Heritage Foundation, the group announced that they would be disbanding in an effort to avoid closer scrutiny.
Pandabuy is a Chinese e-commerce shipping agency website that ships manufactured products from China to the outside world. They are primarily known for shipping counterfeit consumer goods of designer clothing brands as well as expensive shoes made by companies such as Nike.