Data Exposure: Dark Overlord 9/11 Files

In early 2019, a cybercriminal group named The Dark Overlord (TDO) began releasing illegally obtained files related to litigation surrounding the 9/11 terrorist attacks on the World Trade Center (WTC). These files were from a US law firm, but given the broad nature of 9/11 litigation, involved multiple companies worldwide, including insurance providers. TDO targets companies with potentially sensitive or salacious information, believing this improves its chances of extorting the firms for ransom payments.

Recommendations

The primary initial intrusion method for TDO is to exploit exposed RDP ports. We recommend:

• Limiting or securing any machines that have RDP Port 3389 open to the Internet
• In the ZeroFOX platform, enabling Cyber Attack Chatter, Pastebin Mention, and Dark Web Mention rules for relevant entities to monitor for discussion related to your entities and TDO; and
• At the enterprise level, implementing rigorous phishing, password, and security hygiene training for employees.

Details

On December 31st, TDO released a message on Pastebin claiming to have hacked multiple groups, including insurance providers and law firms, resulting in the acquisition of a 10 GB trove of legal documents related to the terrorist attacks on September 11th. As part of their original post, they released a sample of documents to prove the validity of the cache. Additionally, after a crowdfunding effort paid the group roughly $11,000, TDO released another 70MB of documents. The remaining files are still up for sale to the highest bidder or further crowdfunding efforts.

The insurance provider Hiscox Group announced this breach originally in April 2018, without identifying the hacker, when it reported the breach of a US-based law firm it employed for 9/11 litigation. Thus far, there is no information available to indicate TDO has actually hacked any organizations besides the one law firm.