Alpha Team Research: Opportunistic Hackers Case Study

The recent hack on the city of Johannesburg is a great example of an opportunistic attacker and how popular these types of attacks have become. This breach did not appear targeted, or motivated by any factors, but just at the right place at the right time. These types of attacks are relatively common, with hacker groups claiming they compromised a site that wouldn’t typically be a target for attacks, due to the size or scope of the site. However, the attackers were able to find some way to compromise them and attempted to make the hack seem much more impactful than it actually was. While the Johannesburg attack was actually relatively major, it still was an example of how attackers try to capitalize on any possibility to make a name for themselves, regardless of how much notoriety is actually deserved.

Recommendations

Continue monitoring the Alpha Team Tab for reports related to dark web and threat actor activity, such as this one
If you are interested in further insight, reach out to [email protected] for assistance

Details

The Shadow Kill Hackers first posted about the Johannesburg attack last week and claimed they had access to the Domain Controllers for the city. They posted screenshots of the data and explained the victims had until the 28th of October to pay 4 bitcoins to release control back to the owners. Since this happened, the group has been featured in several news articles detailing the attack and who might be behind it. This group took the opportunity to try and market themselves as being something bigger than opportunistic hackers, and have most recently tried to appear "professional" with their recent Twitter bio - "Our main goal is to find security holes on companies and make them pay for us in order to receive a full detailed scenario attack report.". Their new bio sounds like they would provide companies who were attacked, with information as to how the attack was conducted, and what could be done to prevent future attacks.

WindowsLogonHacked Figure 1. Windows Login of compromised machine

In reality, this group, like many others who try this technique, most likely found an exposed system through the use of common internet scanning tools, like Shodan, and found a way in. Given that most governments are not properly equipped to handle cyber attacks and do not have the proper resources to manage and respond to these types of attacks, as with the recent example of Baltimore, this was a perfect target. By targeting victims in certain industries that don't afford them the benefits of being properly secured, attackers can try and capitalize on these attacks and remain in the news, certainly giving them the fame they desire.

Groups like Shadow Kill Hackers have hit before, and as long as the news and media continue to publicize their information and name, groups will continue to target sites like this in order to gain notoriety. While this group hasn't been incredibly active on Twitter besides talking about their few, disparate attacks on websites, an even smaller, more unknown group "BSB Hackers" commented on the Shadow Kill Hackers Twitter page with comments like "BSB hackers Loading in" and "Look out for BSB Hackers" and even more comically "We will attack your main server". This borders on troll-level tweets and wouldn't be worth commenting on except for the fact that Shadow Kill Hackers replied to them and later deleted the tweets. Shadow Kill Hackers replied back "Waiting for you lol Little kids", which was later deleted, but this reads somewhat like Shadow Kill Hackers may have gotten scared with the publicity and possibly tried to attribute this to another group, by quickly making this random group online that appeared the same week as Shadow Kill Hackers.

Figure 2. BSBHackers engaging with Shadow Kill Hackers on Twitter

It is highly unlikely that two random groups would target or be interested in the city of Johannesburg the same week, with both completely unknown groups talking about this city and attack. Because the Shadow Kill Hackers have deleted their comments, it either seems like they are just going to own up to the attacks now, or they want to distance themselves from this cheap tactic to try and misdirect others from themselves. It is also equally possible that the BSB Hackers are trying to piggyback off the new-found attention for this attack and make a name for themselves indirectly, and not having anything to do with the group, to begin with.

Conclusion

Less sophisticated or motivated attackers will often target companies that can't defend themselves properly, and then try to reap the benefits of this media exposure. However, they rarely succeed in becoming staple groups in the security community due to not being legitimate hackers. Related to the quest for notoriety, most APT’s or sophisticated threat groups rarely publicly claim responsibility for attacks and remain unknown until the victim organization releases news about the attack. With the popularity of internet scanners, it's easier now more than ever to quickly identify potential targets of new vulnerabilities, such as the recent vBulletin vulnerability, allowing attackers to target victims of opportunity, rather than a specific mission. This allows attackers to pick juicier targets which may give them the biggest reward. For instance, attackers leveraged vBulletin exploits against forums that had the most sensitive data, used for blackmailing victims. In the case of this attack, it's possible they figured the city wouldn't be interested in not paying due to the recent cases of this attack and how costly it becomes.