ARES, a notorious cybercrime gang, is making waves on the dark web by selling confidential data stolen from both corporate entities and government agencies.
In late 2021, the threat actor in question made its presence known on Telegram and has been linked to the RansomHouse ransomware, the KelvinSecurity data leakage platform, as well as the Adrastea network access group.
ARES Group runs its own database leak website and forum, which may fill the void left by the now-defunct Breached forum.
See also: Amazon stopped selling Flipper Zero
Cyfirma's research shows that the ARES malicious actor exhibits a worrying tendency to collaborate with other dangerous cybercriminals, demonstrating cartel-like behavior.
ARES Leaks
ARES Leaks is an online platform that provides access to leaked data from 65 different countries around the world, including the US, France, Spain, Australia and Italy.
The site hosts a wide variety of confidential information, including phone numbers, emails, customer data, and SSNs. It also offers access to B2B databases in addition to forex information from government leaks and passports!
The group accepts cryptocurrency payments from members who want to access the data offered or purchase one of the available services, which cover vulnerability exploitation, pen-testing, malware development, and distributed denial of service (DDoS) attacks.
See also: Researchers identify new hacking group FusionCore
As Cyfirma reports, ARES Leaks activity increased after Breached was shut down.
By the end of 2022, ARES wanted to hire malware writers and experienced pen-testers, who could work in Syria for payment via cryptocurrency.
ARES not only provides general channels, but also offers exclusive and VIP channels. These probably contain more valuable data breaches from high-profile organizations.
Cyfirma revealed that ARES is trying to gain military access and databases, as evidenced by placing advertisements on cybercrime forums.
LeakBase
LeakBase, launched in early 2023, is another project backed by the ARES threat actor. Intensive marketing and the closure of the infamous hacking forum Breached led to many users signing up for the service.
This platform is hosted on the clear web and is free for anyone to join, providing access to free databases, a marketplace for selling leaks, vulnerabilities, techniques, and services. Plus a secure payment system that inspires trust in users.
In addition, the forum provides platforms for programming, hacking suggestions and tutorials, social engineering and penetration approaches, encryption techniques, anonymity methods, as well as guides and discussions on operational security.
Unlike Breached, LeakBase is still growing and gaining more attention from hackers. It has the potential to become a one-stop shop for cybercriminals looking for services and data in the near future.
ARES is an impressively structured threat group, which continues to expand its activities and services, allowing it to cover a wide range of cybercrime interests.
Cyfirma is convinced that ARES sees the closure of Breached as an opening to quickly expand and secure its position in the cybercrime sector.
Information source: bleepingcomputer.com
