Rescator

Last updated

Rescator is the name of a Ukrainian hacker specialising in the sale of credit card details. According to Russian cyber-security consultancy Group-IB, "Rescator" (AKA Helkern and ikaikki) runs his own marketplace at rescator.cm and uploaded over 5 million card details onto the SWIPED carder marketplace. [1]

Credit card details have been stolen from places like Minnesota and the United Kingdom, [2] the website allows searches by zip code so that stolen card numbers can be cashed out more locally to their victim to avoid alerting banks. [3] Unlike the now defunct Tor Carding Forums, the site is free to use, payments requiring direct Bitcoin payments to sellers without escrow features more common on darknet markets. [4] Many of the stolen details from the Target, [5] Home Depot [6] and Sally Beauty [6] data breaches ended up at the site.

In March 2014, the site was briefly defaced by a rival hacker. [7]

Related Research Articles

<span class="mw-page-title-main">ShadowCrew</span> Cybercrime forum (2002–2004)

ShadowCrew was a cybercrime forum that operated under the domain name ShadowCrew.com between August 2002 and November 2004.

<span class="mw-page-title-main">TJ Maxx</span> American discount department store chain owned by TJX Companies

TJ Maxx is an American discount department store chain. It has more than 1,000 stores in the United States, making it one of the largest clothing retailers in the country. TJ Maxx is the flagship chain of the TJX Companies. It sells men's, women's and children's apparel and shoes, toys, bath and beauty products, accessories, jewelry, and home products ranging from furniture and decor to housewares and kitchen utensils.

<span class="mw-page-title-main">Timeline of Internet conflicts</span>

The Internet has a long history of turbulent relations, major maliciously designed disruptions, and other conflicts. This is a list of known and documented Internet, Usenet, virtual community and World Wide Web related conflicts, and of conflicts that touch on both offline and online worlds with possibly wider reaching implications.

Heartland Payment Systems, Inc. is a U.S.-based payment processing and technology provider. Founded in 1997, Heartland Payment Systems' last headquarters were in Princeton, New Jersey. The company was acquired by Global Payments for $4.3 billion in 2016.

<span class="mw-page-title-main">Credit card fraud</span> Financial crime

Credit card fraud is an inclusive term for fraud committed using a payment card, such as a credit card or debit card. The purpose may be to obtain goods or services or to make payment to another account, which is controlled by a criminal. The Payment Card Industry Data Security Standard is the data security standard created to help financial institutions process card payments securely and reduce card fraud.

<span class="mw-page-title-main">Albert Gonzalez</span> American computer hacker and criminal

Albert Gonzalez is an American computer hacker, computer criminal and police informer, who is accused of masterminding the combined credit card theft and subsequent reselling of more than 170 million card and ATM numbers from 2005 to 2007, the biggest such fraud in history. Gonzalez and his accomplices used SQL injection to deploy backdoors on several corporate systems in order to launch packet sniffing attacks which allowed him to steal computer data from internal corporate networks.

Teamp0ison was a computer security research group consisting of 3 to 5 core members. The group gained notoriety in 2011/2012 for its blackhat hacking activities, which included attacks on the United Nations, NASA, NATO, Facebook, Minecraft Pocket Edition Forums, and several other large corporations and government entities. TeaMp0isoN disbanded in 2012 following the arrests of some of its core members, "TriCk", and "MLT".

Anonymous is a decentralised virtual community. They are commonly referred to as an internet-based collective of hacktivists whose goals, like its organization, are decentralized. Anonymous seeks mass awareness and revolution against what the organization perceives as corrupt entities, while attempting to maintain anonymity. Anonymous has had a hacktivist impact. This is a timeline of activities reported to be carried out by the group.

UGNazi is a hacker group. The group conducted a series of cyberattacks, including social engineering, data breach, and denial-of-service attacks, on the websites of various organizations in 2012. Two members of UGNazi were arrested in June 2012; one was incarcerated. In December 2018, two members of UGNazi were arrested in connection with a murder in Manila.

<span class="mw-page-title-main">NullCrew</span>

NullCrew was a hacktivist group founded in 2012 that took responsibility for multiple high-profile computer attacks against corporations, educational institutions, and government agencies.

A darknet market is a commercial website on the dark web that operates via darknets such as Tor and I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the sale of legal products. In December 2014, a study by Gareth Owen from the University of Portsmouth suggested the second most popular sites on Tor were darknet markets.

<span class="mw-page-title-main">Carding (fraud)</span> Crime involving the trafficking of credit card data

Carding is a term of the trafficking and unauthorized use of credit cards. The stolen credit cards or credit card numbers are then used to buy prepaid gift cards to cover up the tracks. Activities also encompass exploitation of personal data, and money laundering techniques. Modern carding sites have been described as full-service commercial entities.

Pakbugs was a Pakistani-based security forum offering security releases updates, discussion of hacking, credit card fraud, phishing and other forms of computer crime; as well as trading in malware, bank login details and stolen credit card numbers. The forum was shut down after multiple raids by Pakistani Federal Investigation Agency on its members in 2010, in which five individuals were arrested, with the alleged founder suspected to remain at large in Riyadh.

Alex Holden is the owner of Hold Security, a computer security firm. As of 2015, the firm employs 16 people.

<span class="mw-page-title-main">Point-of-sale malware</span>

Point-of-sale malware is usually a type of malicious software (malware) that is used by cybercriminals to target point of sale (POS) and payment terminals with the intent to obtain credit card and debit card information, a card's track 1 or track 2 data and even the CVV code, by various man-in-the-middle attacks, that is the interception of the processing at the retail checkout point of sale system. The simplest, or most evasive, approach is RAM-scraping, accessing the system's memory and exporting the copied information via a remote access trojan (RAT) as this minimizes any software or hardware tampering, potentially leaving no footprints. POS attacks may also include the use of various bits of hardware: dongles, trojan card readers, (wireless) data transmitters and receivers. Being at the gateway of transactions, POS malware enables hackers to process and steal thousands, even millions, of transaction payment data, depending upon the target, the number of devices affected, and how long the attack goes undetected. This is done before or outside of the card information being (usually) encrypted and sent to the payment processor for authorization.

In summer 2018, a data breach affected almost 500,000 customers of British Airways, of which almost 250,000 had their names, addresses, credit card numbers and CVV cards stolen. The attack gained access to British Airways systems via the account of a compromised third party and escalated their account privileges after finding an unsecured administrator password. The attacker stole data that British Airway's was improperly recording and also redirected users of British Airways site to a bogus one that was designed to steal more data. In October 2020 the ICO fined British Airways £20 million for breaches of GDPR related to the breach.

Anonymous, a decentralized international activist and hacktivist collective, has conducted numerous cyber-operations against Russia since February 2022 when the Russian invasion of Ukraine began.

References

  1. Cook, James (17 October 2014). "This Ukrainian Hacker Is One Of The Biggest Stolen Credit Card Traders On The Planet". The Register. Business Insider . Retrieved 31 March 2019.
  2. White, Geoff (6 November 2014). "Thousands at risk from credit card fraud website" . Retrieved 2 August 2015.
  3. Montemayor, Stephen (2 August 2015). "Out-of-state criminals bring cloned credit card schemes to Twin Cities" . Retrieved 2 August 2015.
  4. KIELL (11 December 2014). "A Carder's First Experience". Archived from the original on 18 April 2015. Retrieved 2 August 2015.
  5. Schwartz, Mathew J. (5 September 2015). "Banks Reacting Faster to Card Breaches" . Retrieved 2 August 2015.
  6. 1 2 Krebs, Brian (May 2015). "Deconstructing the 2014 Sally Beauty Breach" . Retrieved 2 August 2015.
  7. "Underground Payment Card Store Rescator Hacked and Defaced" . Retrieved 2 August 2015.