Alpha Team Research: Cazanova Haxor Actor Profile

Alpha Team has been tracking a phishing kit author, who has just released a new kit targeting Netflix customers, as of 08.26.2019 at approximately 4 PM EST. This actor is known as Cazanova Haxor, and has been active on both Facebook and Twitter since 2014. This actor’s phishing kits are heavily marketed on a public Facebook group, which has been online since 06.20.2017. This group at present has 20,703 likes and 40,801 follows.

Recommendations

Consider enable the Cyber Attack Chatter rule to monitor for phishing activity related to your organization.
Never click links in emails from unknown senders, or in emails that seem in any way suspiscious.

Details

This actor has written and released phishing kits targeting at least three major US companies. Targets include organizations in the entertainment, software, and financial services sectors. In addition to these phishing kits, Cazanova Haxor has also developed a mass-mailer tool called ZLetter. Graphics and design of the kits associated with this actor are of a higher quality than the average phishing kit, suggesting some level of professionalism.

Figure 1. Teaser graphic posted to marketing Facebook page, prior to Cocaine kit release.

Payment and Purchasing Structure

Figure 2. Pricing of various kits offered by actor Cazanova Haxor.

Kits sold by this author go for $99 each, while the mass-mailer is priced depending on the length of time desired. Payment and licensing is done using a central site, via bitcoin, to an address specified on the site. After submitting payment to a specified wallet, users are asked to submit their own bitcoin wallet address to the site, so that kits may be enabled on accounts that have paid for them. The payment wallet used for these kits has been active since June 29, 2019.

Figure 3. Activity to and from payment wallet from 06.29.19 to 08.27.19.

At present bitcoin pricing, this wallet has been the recipient of just under $3000 USD, which indicates that up to 30 kit licenses could have been purchased over the two-month activity period of this wallet.

Kit Features

Figure 4. Features of the Cocaine kit as listed by actor.

Kits generally, as described on the licensing site, indicate that they can be used in multiple languages, and will even validate that emails provided to the kit belong to valid user accounts. Kits phish for login credentials, identity documents, selfies of users with their identity documents, as well as photos of credit cards. Some features appear to be ubiquitous to kits developed by Cazanova, as all kits are advertised as having advanced anti-bot capabilities, Captcha systems, and free updates, among other things. True to their word, this author does actively update kits, releasing a new update every few weeks.

Figure 5. Update 1.5 of the Adrenaline kit.

Conclusion

Although this operation appears to be smaller in scale, the kits produced by Cazanova Haxor are of high quality to the point that they are of concern to the organizations targeted by this actor. Kit design is excellent, and expertly imitates the sites being impersonated. These landing pages are convincing enough that users who are targeted in these scams could very easily fall for them. These kits demonstrate that although phishing attacks are nothing new or novel, they will likely remain popular because they can be lucrative if executed well, as in this case.