7 ms·
German police name alleged leaders of GandCrab and REvil ransomware groups
- alexmocki 7mo ago[flagged]
- raverbashing 7mo agoAh yes a business like the mafia
- tgv 7mo agoThe parent commenter has apparently never heard of organized crime.
- kgeist 7mo agoFound his record in Russia's official company registry. This is what he officially does as an entepreneur: 56.10 — Restaurant activities and food delivery services 47.23 — Retail sale of fish, crustaceans, and mollusks in specialized stores 47.25.12 — Retail sale of beer in specialized stores 47.25.2 — Retail sale of soft drinks in specialized stores 47.29.39 — Retail sale of other food products in specialized stores, not included in other groups 68.20 — Lease and management of own or leased real estate Money is reinvested into selling beer and fish :) Interestingly, he registered all that in 2019, just when the ransoms started.
- ivan_gammel 7mo agoClassic money laundering.
- tokai 7mo ago> 56.10 — Restaurant activities and food delivery services That one is a classic for russian criminals and warlords.
- randomNumber7 7mo agoThis has nothing to do with russia. All over the world it's an obvious choice to use it for money laundering.
- tokai 7mo agoYevgeny Prigozhin was well known for his restaurants and catering businesses.
- randomNumber7 7mo agoAnd you don't understand simple logic.
- tokai 7mo agoAnd you should reread the HN guidelines.
- ecshafer 7mo agoI find it entertaining that even as part of a Russian hacking gang, the real threat is the Russian tax authorities. Regardless of how you got the money, need to pay the taxes.
- diath 7mo agoThat's not specific to Russia, almost every country in the world requires you to report illegal income for tax purposes, including the US.
- jojobas 7mo agoHis first, middle and last names are among the more popular, chances are you found a namesake.
- kgeist 7mo agoSchukin isn't a very common last name (definitely not Ivanov-tier). The first name, the patronymic (his father is Maksim) and the last name all match, as well as the city (the article says he lives in Krasnodar). In fact, this Krasnodar-based entrepreneur is the only person that shows up in the search at all for "Daniil Maksimovich Schukin". Not to say the business was registered right when the ransoms started (2019). Too many coincidences if it's just a namesake.
- wat10000 7mo agoGo look at the al Qaeda emails recovered from the raid that killed bin Laden and you'll find all the same stuff. Turns out that the way businesses operate is just a good way to operate human organizations in general, whether their goal is to sell widgets or blow up infidels.
- Phelinofist 7mo agoSpiegel recently did a video on them: https://www.youtube.com/watch?v=HuwRrqM6H1M https://www.youtube.com/watch?v=HuwRrqM6H1M
- nailer 7mo agoFeels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information. Identifying a criminal is ethical.
- cucumber3732842 7mo ago>Identifying a criminal is ethical. This outsourcing of one's morals to the state is excessive even by already high western white collar internet standards. Now, make no mistake, these guys are up to no good and probably should be identified and prosecuted, but to just declare that a bad thing is now good because government is doing it is basically an abdication of one's moral compass. At best this is still a bad thing but a necessary one because all the other options are worse. Like shooting someone in self defense, or putting someone in a cage for doing sufficiently bad things. Edit: I'll admit I played too loose with ethics vs morality here, but still the point stands.
- KingOfCoders 7mo agoPutting someone on a (most) wanted list is "doxing"? [Edit] "An international search is underway for Daniil Maksimovich SHCHUKIN on suspicion of numerous counts of gang-related and commercial extortion using ransomware to the detriment of commercial enterprises, public facilities, and institutions."
- mc32 7mo agoUnfortunately language tends to get diluted. Nowadays in pop culture it means publishing anyone's personal information, usually against their wishes.
- KingOfCoders 7mo ago“When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean — neither more nor less.”
- Aurornis 7mo agoThis does seem close to the original intent of "doxxing", where information ("dox") is publicized that connects a real-world identity to a previously anonymous online persona. These are hackers in the classic sense who were going out of their way to stay anonymous. The dilution of the word doxxing has been interesting, though. Some of the recent "doxxing" controversies have been about figures who weren't all that anonymous to begin with. The pop culture meaning has been extended to cover any mention of someone's real identity at all, even if it wasn't a secret.
- lovich 7mo agoBeyond diluting it also seems that people are increasingly under the impression that internet rules are also the same in real life. I’ve been seeing it come up in discussions about court cases where people are under the belief that requiring online personalities real names in the court documents is somehow illegal because it’s doxxing.
- 7mo ago
- dfir-lab 7mo ago[flagged]
- user070707 7mo ago[flagged]
- jojomodding 7mo agoSo apparently some CCC-connected hackers already unmasked one of them years ago (as reported in the update, which could have also just linked to the talk here: https://media.ccc.de/v/37c3-12134-hirne_hacken_hackback_edition#t=1440 https://media.ccc.de/v/37c3-12134-hirne_hacken_hackback_edit... ) Makes you wonder if the investigators discovered this independently, or decided to maybe ask the hackers already involved in defending against them for help...
- hobofan 7mo agoI'm not deep into the topic, but AFAIK there generally isn't a warm connection between the CCC and the BND in Germany (in the recent years mostly due to the BNDs involvement ins spying on German citizens, but I think there is also deeper history there). If a hacker collaborates with the BND they do run a risk of many of their peers not wanting to collaborate with them anymore.
- jojomodding 7mo agoMaybe the special agents watched the talk in their free time
- foepys 7mo agoIt also has something to do with the so called "Hackerparagraph" [1] under which whitehat hacking is basically impossible in Germany. Even writing a program that could potentially be used for hacking is a crime. If you followed the law word for word the authors of e.g. curl could be charged under this law. 1: https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hens_und_Abfangens_von_Daten https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hen... [de]
- PowerElectronix 7mo agoIt'll nevee cease to amaze me how some countries find such creative ways to stifle innovation while they look to be caring about safety or what not.
- alistairSH 7mo agoHow is "this is the name of the formerly anonymous extortionist" doxxing? Unless there's something not covered in the article, his current address, family members, phone, etc were not listed. That's not doxxing; that's "here's a guy were want to arrest."
- deleted 7mo ago[deleted]
- randomNumber7 7mo agoThat wouldn't sound cool. Especially as noone actually gives a fuck about what germany wants.
- perlgeek 7mo agoIt seems to me that the meaning of the word "doxxing" has slowly drifted to mean "revealing information about somebody without their consent", be it by state actor, a company or an individual. BTW, what do you think will happen when people find out that their neighbor is secretly a pretty wealthy criminal? Attempts of theft, robbery and extortion have happened in the wake of such announcements. There was even a case where somebody attempted to impersonate an intelligence officer and try to force a recently doxxed cyber criminal to bribe them.
- alistairSH 7mo agowhat do you think will happen when people find out that their neighbor is secretly a pretty wealthy criminal? Who knows, but I'm also not sure how you avoid that situation. Presumably, to be "doxxed" like this, there's substantive evidence he is actually the criminal. Strikes me as just one more downside of being a successful (but now identified) extortionist.
- pests 7mo ago> what do you think will happen when people find out that their neighbor is secretly a pretty wealthy criminal? Call the police? Isn't this the point?
- crest 7mo agoSince when does putting criminals on official wanted lists count as doxxing?!? If they want their information taken down they just have to show up in court.
- ddtaylor 7mo agoI think people are getting stuck on the concept of the word doxing here. In anonymous online hacking circles, the idea that you're exposing anyone's OPSEC at all is considered basically doxing. People do it regularly, but it's seen as a clear indication of being an enemy. Some take a "full disclosure" style and expose all OPSEC failures instantly and transparently, because otherwise people seem to collect OPSEC failures and make it seem to be extortion itself, like saying "hey remember that time you signed off with your real name?" or "I know your clearnet address"
- twodave 7mo agoSome of the comments here (and lately on HN in general) are very concerning to me. Are we really going to pretend that people accused of real crimes shouldn’t be arrested, charged and, if found guilty, have an appropriate sentence? It doesn’t take many more than 2 brain cells rubbing together to see that that won’t end well. Whataboutism, political differences, and even real injustices in my opinion do not make this a reasonable position.
- randomNumber7 7mo agoIt probably depends on what people think about the laws that define what a "real crime" is. E.g. in germany it was a real crime to grow some weed. Now it's legal, but even before a lot of reasonable people didn't want someone go to jail over weed.
- signatoremo 7mo agoSure, but do you consider this specific case a real crime?
- Computer0 7mo ago[flagged]
- twodave 7mo agoWrong. "No people I agree with were harmed," perhaps. This is no different than cronyism.
- Computer0 7mo agobusinesses are not people
- DFHippie 7mo agoIf a business is destroyed by ransomware, all its employees lose their jobs. The business's customers lose the services the business was providing. The families supported by these jobs are now all at risk. All that money goes somewhere. Much of it goes towards clothing, feeding, and housing people. Also, in most places it's a crime to rob anyone, even selfish assholes.
- mmanfrin 7mo agoI feel accepted spelling of the word is 'doxxes'; doxes in my head reads as 'dokeses'. Also talk about a headline that would mean absolute gibberish just a couple decades ago.
- preetigagarwal 7mo agoThese groups typically exploit unpatched vulnerabilities and exposed credentials. Most companies don't discover they're vulnerable until after a breach. Regular security audits are the only real defense.
- AugSun 7mo ago... and "leading security website" cuts off any traffic from VPNs. What an irony. What's next, ads?
- colechristensen 7mo agoEh, being a high profile security website, VPNs are where the harassing traffic comes from, and I'm sure there's no lack of it. VPN "security" is a bit of a joke because why would I trust some VPN provider any more than my ISP? Everything is HTTPS these days anyway.
- fwn 7mo ago> [...] why would I trust some VPN provider any more than my ISP [...] Of course, whether or not to use a VPN always depends on the specifics. (threat model, circumstances, VPN provider, etc.) I am with the biggest telecoms provider in Germany, and I trust them about as far as I can throw them. They are known for censoring their DNS servers, being opaque about government requests, and creating artificial bottlenecks to extort money from companies in order to avoid throttling.
- deleted 7mo ago[deleted]
- NeoBild 7mo ago[dead]