A criminal organization has created a fake company to recruit potential employees, according to researchers from intelligence firm Recorded Future and Microsoft Corp. The fake company uses the name Bastion Secure, the researchers said. On a professional-looking website, the company says it sells cybersecurity services. But the site is operated by a notorious hacking group called Fin7, Recorded Future and Microsoft said.
See also: Chinese hackers behind attacks on ten Israeli hospitals?
See also: Hackers breached the website of the Ministry of Culture and Sports
The Fin7 group is believed to have hacked hundreds of businesses, stolen more than 20 million customer records and wrote the software used in a hack that disrupted gasoline deliveries in parts of the Southeastern United States, federal prosecutors and investigators say.
Bastion Secure 's website , which uses the BS logo, has listed jobs that are technical in nature and similar to those you would find at any security company — programmers, system administrators and people who are good at finding bugs in software. The upcoming hires are for nine-hour shifts and a scheduled work schedule: Monday through Friday, according to the company's website. Lunch breaks are provided, the website says.
The attempt to impersonate a legitimate company for recruitment purposes represents a new development by ransomware vendors to develop and spread a scourge that has disrupted meat production, hospital care, education and hundreds of businesses. With hundreds of millions of dollars in illicit profits, ransomware operators are increasingly operating like criminal startups with specialized support staff, software development, cloud-computing services and media relations, security researchers say.
Recorded Future shared its findings with the Wall Street Journal and planned to publish them in a post on Thursday. Microsoft officials gave a presentation on their discovery earlier this month at a conference hosted by cybersecurity firm Mandiant.
Emails to an address listed on the Bastion Secure website went unanswered. A phone call to an Israeli number listed on the website was answered by a Russian-speaking man. “I’m just a human being. I have no connection to any cybersecurity company,” he said before hanging up.
The recruitment effort appears to be focused on Russian speakers, the researchers said. While criminals have traditionally operated on the dark web — recruiting associates on criminal forums — the demands of the growing Fin7 operation appear to have driven it to recruit talent this way, security researchers say.
See also: Hackers are becoming more aggressive in breaking into RDP services
Information-technology jobs advertised by Bastion Secure offer salaries between $800 and $1,200 per month.
The Fin7 group has hacked thousands of computer systems and for years focused on stealing and selling credit card information. The 70-person group caused more than $3 billion in losses to companies and individuals, federal prosecutors said.
The group recently switched from stealing card information to ransomware and now operates a ransomware service and conducts interventions to develop file-encrypting, said Nick Carr, a security analyst at Microsoft, speaking at the Mandiant conference.
Microsoft believes Fin7 produced the software used in the hack that disrupted operations at Colonial Pipeline Co. in the spring. The actual hack is believed to have been carried out by a criminal affiliate of Fin7, Mr. Carr said in his presentation. Fin7 marketed the ransomware operation under the name DarkSide, but more recently called it BlackMatter, the researchers say.
Information source: wsj.com
