Alpha Team Threat Actor Update: Gorka9 and US Election Databases

On September 1, 2020, Russian newspaper Kommersant published an article detailing a leak of US voter databases on an underground darknet forum. The Washington Post published an article covering the event later that day. The actor leaking the databases goes by the alias “Gorka9” and the forum in mention was xss[.]is. Since June 11, 2020, Gorka9 created 5 threads providing direct downloads to “Voter Registration Databases” from Florida, Arkansas, Connecticut, Michigan, and North Carolina. Based on Gorka9’s participation within XSS, we assess with high confidence that Gorka9 is a data broker, and although they have been highlighted to have a focus on databases containing voter data, Gorka9 deals and will continue to deal large databases for monetary gain.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If not already enabled, turn on the dark web chatter rule to search for terms related to your organization on the dark web

Details

Data brokers participate in obtaining databases, combolists, and target lists within the community through buying, selling, trading, or stealing this data. Although US-based voter databases were the highlight of the Kommersant article, Gorka9 also leaked data from multiple countries and products, including Russia, China, Indonesia, UK, Ukraine and has commented on or created 109 threads since June 11 2020 pertaining to obtaining these large datasets. Some of these threads include leaking or looking to obtain databases related to the Catho breach from Brazil, a Facebook-related data breach for users from Indonesia, a Chinese shoppers database, a Vologda-based Russian registration dataset, and a large Ukrainian voter registration database.

Gorka9 has become a topic of interest on XSS, with a thread being posted on 2 September 2020 by XSS user fedor007 discussing the article and the unwanted attention on the forum. An admin replied early in the thread (the thread, as of 4 September 2020, is now up to 3 pages), commenting on how the article brings unwanted attention to the forum, as well as criticizing the article for creating drama about the US elections.

Figure 1: Admin responding to the spotlight on XSS and Gorka9

Gorka9 responded on 3 September 2020, where they commented on how they shouldn’t post anything related to “Pindos” (pejorative slang for Americans) at the request of XSS admins.

Figure 2: Gorka9’s response to fedor007’s thread detailing the story

Based on the notoriety of the voter database story pinning Gorka9 and XSS, as well as the response from the forum community and the XSS admin, it is almost certain that the exchange of these datasets from Gorka9 and other brokers will be moved away from XSS and into other forums or private chats such as Jabber. We assess that it is probable that XSS will change its model of membership to reduce the risk of exposure to journalists and “unwanted attention”.

Why trade voter registration databases?

The reason voter registration databases were highlighted in this particular story is probably due to the upcoming American elections. XSS is a Russian-based cybercrime forum, and so highlighting the connection between Russian-speaking actors and the trading of voter registration databases can yield an alarming response from readers. Although the databases were from applications or open-source datasets, the intent of the database does not matter as much as the contents it contains. For example, many of these databases contain full names, dates of birth, addresses, and phone numbers. This is useful information for targeting victims for fraud or for phishing. These databases also contain demographic details, so they can also be used for setting up pretexts for scams. Alpha Team assesses that the reason these were probably for fraud-related purposes, rather than trying to influence elections, especially since Gorka9 and other actors trade datasets that have nothing to do with elections.