Criminals sell access to rooted servers via online shop

Share this article:
Criminals sell access to rooted servers via online shop
Criminals sell access to rooted servers via online shop

Researchers have discovered an online store where criminals sell access to hacked servers, another cautionary example of miscreants' commercialization of stolen data.

Alberto Ortega, a researcher at AlienVault Labs, revealed the underground activities in a Wednesday blog post, saying that server admin credentials were being trafficked on a site called “SSH–Zone.” With the stolen credentials, attackers can leverage a conduct a number of malicious activities, including distributing malware, spamming victims or installing botnet command-and-control servers.

The online shop sells login information for admins with accounts on Plesk and OpenSSH, software used to access and manage servers. According to a screen shot of the SSH–Zone website, saboteurs are specifically selling access to hacked Linux servers.

Attackers amassed the login credentials they are selling by using an automated method for cracking credentials. 

Researchers believe that Russian attackers run the operation because site administrators spoke Russian and some software installed on the server was written in that language.

This undertaking meshes with the general trend of cyber crooks increasingly commercializing their activities.

A report released this week from online fraud prevention firm 41st Parameter, titled “The Growing Threats of Cyber Crime: Five Trends and Takeaways," said the “promise of significant profit has given rise to a complex fraud ecosystem,” encouraging scammers to make their activities more organized.

The report said stolen credentials often are “packaged in a standardized format,” and later used to further extract information from victims, through spear phishing email campaigns targeting unsuspecting users.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.