Dark Basin
| Type | Advanced persistent threat |
|---|---|
| Purpose | Cyberespionage |
Region | India |
| Methods | Spear phishing |
Parent organization | BellTroX InfoTech Services |
| Affiliations | Wirecard, ExxonMobil |
Dark Basin is a hack-for-hire group, discovered in 2017 by Citizen Lab.[1] They are suspected to have acted on the behalf of companies such as Wirecard[2] and ExxonMobil.[3]
Background
[edit]In 2015, Matthew Earl, a managing partner at ShadowFall Capital & Research, began to study Wirecard AG hoping to short sell them. Wirecard had just announced the purchase of Great Indian Retail Group for $254 million,[4] which seemed overpriced to Earl. In February 2016, he started to write publicly about his discoveries under the alias Zatarra Research & Investigations,[5] accusing Wirecard of corruption, corporate fraud, and money laundering.[6]
Soon after, the identity of Zatarra Research & Investigations was revealed online, along with surveillance pictures of Earl in front of his house. Earl quickly realized that he was being followed. Employees from Jones Day, a law firm representing Wirecard,[7] came to visit Earl and gave him a letter, accusing him of collusion, conspiracy, defamation, libel, and market manipulation.[8] Earl also started to receive targeted phishing emails, appearing to be from his friends and family members.[2] In the spring of 2017, Earl shared those emails with Citizen Lab, a research laboratory specializing in information control.[8]
Citizen Lab's investigation
[edit]Initial findings
[edit]Citizen Lab discovered that the attackers were using a custom URL shortener that allowed enumeration, giving them access to a list of 28,000 URLs. Some of those URLs redirected to websites looking like Gmail, Facebook, LinkedIn, Dropbox or various webmails – each page customized with the name of the victim, asking the user to re-enter their password.[9]
Citizen Lab baptized this hacker group 'Dark Basin' and identified several clusters among the victims:[1]
- American environmental organizations linked to the #ExxonKnew campaign:[10] Rockefeller Brothers Fund, Climate Investigations Center, Greenpeace, Center for International Environmental Law, Oil Change International, Public Citizen, Conservation Law Foundation, Union of Concerned Scientists, M+R Strategic Services or 350.org
- US media outlets
- Hedge funds, short sellers and financial journalists
- International banks and investment firms
- Legal firms in the US, UK, Israel, France, Belgium, Norway, Switzerland, Iceland, Kenya, and Nigeria
- Petroleum and energy companies
- Eastern European, Central European and Russian oligarchs
- Well-resourced people involved in divorces or other legal matters
The variety of targets made Citizen Lab think of a mercenary activity. The research laboratory confirmed that some of these attacks were successful.
Links to India
[edit]Several clues allowed Citizen Lab to assert with high confidence that Dark Basin was based in India.[1]
Working hours
[edit]Timestamps in Dark Basin phishing emails were consistent with working hours in India, which has only one timezone: UTC+5:30.[1]
Cultural references
[edit]The instances of the URL shortening service used by Dark Basin had names related to Indian culture: Holi, Rongali and Pochanchi.[1]
Phishing kit
[edit]Dark Basin let their phishing kit source code, including some log files, available online. The source code was configured to print timestamps in India's timezone. The log file, that showed some testing activity, included an IP address based in India.[1]
Links to BellTroX
[edit]Citizen Lab believes with high confidence, that BellTroX, also known as BellTroX InfoTech Services and BellTroX D|G|TAL Security, is the company behind Dark Basin.[1] BellTroX, a Delhi-based company,[11] advertises on its website doing activities such as penetration testing, certified ethical hacking, and medical transcription. BellTroX employees are described as noisy[1] and were often posting publicly about their illegal activities.[1] BellTroX's founder Sumit Guptra[12] has been previously indicted and charged in the United States for a hack-for-hire scheme on the behalf of ViSalus.[13]
BellTroX used the CV of one of their employees to test Dark Basin's URL shortener. They also publicly posted screenshots of links to Dark Basin's infrastructure.[1]
Hundreds of people, working in corporate intelligence and private investigation, endorsed BellTroX on LinkedIn. Some of them are suspected to be possible clients. Those endorsements included a Canadian government official, an investigator at the US Federal Trade Commission, law enforcement officers and private investigators with prior roles in the FBI, police, military and other branches of government.[1]
On June 7, 2020, BellTroX took down their website.[1] In December 2021, Meta (Facebook) banned BellTroX as a "cyber-mercenary" group.[14][15]
Reactions
[edit]Both Wirecard and ExxonMobil have denied any involvement with Dark Basin.[16][17]
References
[edit]- ^ a b c d e f g h i j k l Scott-Railton, John; Hulcoop, Adam; Razzak, Bahr Abdul; Marczak, Bill; Anstis, Siena; Deibert, Ron (2020-06-09). "Dark Basin - Uncovering a Massive Hack-For-Hire Operation". Citizen Lab. Archived from the original on 2020-09-30. Retrieved 2021-02-28.
- ^ a b Rosin, Hanna (2020-06-09). "Dark Basin: Global Hack-For-Hire Organization That Targeted Thousands Over The Years". All Things Considered. NPR. Archived from the original on 2020-11-15. Retrieved 2021-02-28.
- ^ Murphy, Paul (2020-06-09). "Paid hackers targeted thousands of people and hundreds of institutions worldwide, report says". Financial Times. Archived from the original on 2020-06-26. Retrieved 2021-02-28 – via the Los Angeles Times.
- ^ "Wirecard buys Great Indian Retail Group payments business". Reuters. 2015-10-27. Archived from the original on 2021-03-01. Retrieved 2021-02-28.
- ^ O'Donnell, John (2020-07-16). "Germany's long, lonely campaign: Battling Wirecard's short sellers". Reuters. Archived from the original on 2020-11-19. Retrieved 2021-02-28.
- ^ Davies, Paul J. (2020-06-22). "Short sellers made $2.6 bln off Wirecard plunge". MarketWatch. Archived from the original on 2021-02-05. Retrieved 2021-02-28.
- ^ Davies, Paul J.; Chung, Juliet (2020-06-20). "Short Sellers Made $2.6 Billion Off Wirecard's Plunge, but Not Without Scars". The Wall Street Journal. Archived from the original on 2020-06-20. Retrieved 2021-02-28.
- ^ a b "Dark Basin – Darknet Diaries". Darknet Diaries. 2020-10-24.
- ^ Galperin, Eva; Quintin, Cooper (2017-09-27). "Phish For the Future". Electronic Frontier Foundation. Archived from the original on 2021-01-16. Retrieved 2021-02-28.
- ^ Hong, Nicole; Meier, Barry; Bergman, Ronen (2020-06-10). "Environmentalists Targeted Exxon Mobil. Then Hackers Targeted Them". The New York Times. Archived from the original on 2021-02-01. Retrieved 2021-02-28.
- ^ Stubbs, Jack; Satter, Raphael; Bing, Christopher (9 June 2020). "Obscure Indian cyber firm spied on politicians, investors worldwide". Reuters. Archived from the original on 26 January 2021.
- ^ Kumar, Ankit (2020-06-09). "Dark Basin: Delhi-based "Hack-for-Hire" firm exposed for hacking politicians, non-profits globally". India Today. Archived from the original on 2020-06-27. Retrieved 2021-02-28.
- ^ "Private Investigators Indicted In E-Mail Hacking Scheme" (Press release). United States Attorney for the Northern District of California. 2015-02-11. Archived from the original on 2021-01-07. Retrieved 2021-02-28.
- ^ "Meta releases new threat report on surveillance for hire industry". The Economic Times. 17 December 2021. Archived from the original on 17 December 2021.
- ^ Dvilyanski, Mike; Agranovich, David; Gleicher, Nathaniel (16 December 2021). "Threat Report on the Surveillance-for-Hire Industry" (PDF). Meta. Archived (PDF) from the original on 16 December 2021.
- ^ Porter, Jon (2020-06-10). "Researchers detail huge hack-for-hire campaigns against environmentalists". The Verge. Archived from the original on 2020-06-10. Retrieved 2021-02-28.
- ^ Murphy, Paul (2021-06-09). "Toronto's Citizen Lab uncovers massive hackers-for-hire organization 'Dark Basin' that has targeted hundreds of institutions on six continents". Financial Times. Archived from the original on 2021-01-25. Retrieved 2021-02-28 – via the Financial Post.