Kaspersky exposes massive underground market selling more than 70,000 hacked servers
June 17, 2016 by Canadian Underwriter
Cybersecurity company Kaspersky Lab has reported that its researchers have uncovered a global forum where cybercriminals can buy and sell access to compromised servers for as little as US$6 each.
The xDedic marketplace, which appears to be run by a Russian-speaking group, Kaspersky Lab said in a press release on Wednesday, currently lists 70,624 hacked remote desktop protocol (RDP) servers for sale from 416 unique sellers in 173 affected countries.
Many of the servers host or provide access to popular consumer websites and services and some have software installed for direct mail, financial accounting and point-of-sale (PoS) processing, Kaspersky said in the release, adding that the servers can be used to “target the owners’ infrastructures or as a launch-pad for wider attacks, while the owners, including government entities, corporations and universities, have little or no idea of what’s happening.”
“xDedic is a powerful example of a new kind of cybercriminal marketplace: well-organized and supported, and offering everyone from entry-level cybercriminals to APT (adaptive threat division) groups fast, cheap, and easy access to legitimate organizational infrastructure that keeps their crimes below the radar for as long as possible,” Kaspersky said in the release.
Example of a server for sale. Photo: Kaspersky Lab.
The cybersecurity company said that a European Internet service provider (ISP) alerted them to the existence of xDedic and the companies worked together to investigate how the forum operates. The process is simple and thorough: hackers break into servers, often through brute-force attacks, and bring the credentials to xDedic. The hacked servers are then checked for their RDP configuration, memory, software, browsing history and more, all features that customers can search through before buying. After that, they are added to a growing online inventory that includes access to:
Servers belonging to government networks, corporations and universities;
Servers tagged for having access to or hosting certain websites and services, including gaming, betting, dating, online shopping, online banking and payment, cell phone networks, ISPs and browsers; and
Servers with pre-installed software that could facilitate an attack, including direct mail, financial and PoS software.
From as little as US$6 per server, members of the xDedic forum can access all of a server’s data and also use it as a platform for further malicious attacks. This could potentially include targeted attacks, malware, DDoS, phishing, social engineering and adware attacks, among others, Kaspersky said. The servers’ legitimate owners are often unaware that their IT infrastructure has been compromised. Furthermore, once a campaign has been completed, the attackers can put access to the server back up for sale and the whole process can begin again, Kaspersky reported.
The xDedic marketplace seems to have opened for business some time in 2014, and has become “significantly more popular” since the middle of 2015. In May of 2016, it listed 70,624 servers from 173 countries for sale, posted in the names of 416 different sellers. “In March 2016, the number was about 55,000, a clear indication that the database of users and servers is carefully maintained and updated,” Kaspersky said in the release.
While 51% of affected countries are listed by Kaspersky as “other,” of the named ones, Brazil was at 9%, followed by China (7%), Russia (6%), India (5%), Spain (5%), Italy (4%), France (4%), Australia (3%), South Africa (3%) and Malaysia (3%).
The group behind xDedic claims that it “merely provides a trading platform and has no links or affiliations to the sellers,” Kaspersky reported. “If the truth be told, the people behind xDedic have created what appears to be a ‘quality’ service – the forum even includes live technical support, special tools to patch hacked servers to allow multiple RDP sessions and profiling tools that upload information about the hacked servers into the xDedic database.” “xDedic is further confirmation that cybercrime-as-a-service is expanding through the addition of commercial ecosystems and trading platforms,” Costin Raiu, Kaspersky’s director, global research and analysis team, said in the release. “Its existence makes it easier than ever for everyone, from low-skilled malicious attackers to nation-state backed APTs to engage in potentially devastating attacks in a way that is cheap, fast and effective. The ultimate victims are not just the consumers or organizations targeted in an attack, but also the unsuspecting owners of the servers: they are likely to be completely unaware that their servers are being hijacked again and again for different attacks, all conducted right under their nose.”