Skip to main content

The Iceman Group

A few days ago I had the pleasure to interview one of the “The Iceman Group” member. I will publish more details soon.

Halfway through May ‘17, Kaspersky Labs revealed an unprecedented DNS attack on an unnamed Brazilian Bank on October 16’.

The attackers, it seems, took control of every DNS in the bank’s network, and by doing so - were able to reroute all bank related traffic through their own malicious servers. The attack lasted for 6 hours, in which countless records of valuable and private client information were leaked into the attacker’s hands.

Now, an individual reveals that the group standing behind this attack was “The Iceman Group”, a rising group in the world of Financial Hacking.

As for now, this is their only known attack, as most attacks apparently carried out by this group have yet been disclosed to the public. However, one of the member of the group have revealed a few details about their attack.

He revealed that “The Iceman Group” started their attack by aiming at the NIC.BR service - the one from which all Brazilian domains get their redirections. From this point on, finding and infecting the DNS servers of the said bank - now revealed to be Banrisul Bank - was a much easier task.

After the successful redirection of the DNS Records of the bank, Iceman turned their own servers into complete replicas of the Bank’s Services. SSL encryption of the traffic aimed for the replica servers was done by tricking the site “Let’s Encrypt” into believing The Iceman’s control over the servers was legit. The individual of the group claims that the group have used an inside access to several bank’s employees email accounts in order to deceive “Let’s Encrypt” company.

Throughout the 6 hours the attack lasted, every login attempt into the bank was transferred through the Iceman Group.

“Let this be a slight warning for you all finance crooks”, those were his last words.

A full interview will be published soon.


Popular posts from this blog

Javascript Miner: Hacker's Wet Dream

Experiencing lags on your computer? You're probably running a miner that consumes 100% of your CPU. Coin Hive (a JavaScript based miner) is becoming rapidly popular among Malware developers.

Coinhive, as a tool, is a JavaScript library that website owners can load on their site. When users access the site, the Coinhive JavaScript code library executes and mines for Monero, but using the user's CPU resources.

Very smart idea as it was meat to be a replacer for publicities. Coinhive launched on September 14, and its authors advertise it as an alternative to classic advertising. Coinhive claims that webmasters can remove ads from their sites, and load the Coinhive library and mine for Monero using a small portion of the user's CPU while the user is navigating the site. Site owners can make money and support their business, but without peppering their visitors with annoying ads.

The idea got some traction, and two days after it launched The Pirate Bay ran it as a tes…

NiceHash: security breach leads to 60 million lost - Iceman is behind?

A dark day for crypto currency miners, NiceHash has been hacked. Closely to 60$ millions (4,736.42 BTC) have been stolen while the bitcoin is crossing the 14k$ mark for the first time.

The hacker's bitcoin address cleary shows the steal of  4,736.42 BTC in a window of 48 hours:

NiceHash users are furious by the time of reaction of the team. It took about 24 hours to realise that big amounts have been stolen.

I've contacted a member of Iceman and knowing this security breach for some reason he explained that NiceHash actually owned their users bitcoin wallets in order to save transactions fees and collect unclaimed BTC. This issue leads to a massive security breach which allow access to all NiceHash wallets. He claimed that by reverse engineering of their miner client, Iceman group was able to access their API. Is Iceman really behind this attack?

ICEMAN: Banks holes like in Cheese

Operation "Emmenthal" is the nickname for a grand-scale phishing campaign targeting bank clients. The goal of the campaign is to receive fraudulent payments by taking actions (e.g. money transfers) on behalf of the legitimate end user.

By phishing the victims with a mobile application which mimics the bank’s genuine application, the hackers steals the two-factor-authentication tokens used during the login (both user/passwords and SMS verification code) and then issuing money transfers by SMS Services offered by the bank, together with sending these sensitive credentials to the hackers infrastructure.

The ICEMAN group, which first came to knowing after contacting me to claim responsibility for the Banrisul Bank attack in Brazil, now claim they have committed many of the reported "Emmental" attacks as well. The hacker’s intentions and motives are shown at first in this exclusive interview.

What was your goal of the attack?

We need more bank accounts to sell. The b…