Threat actor
threat_actor:bayrob_group
Also: Bayrob gang, Bayrob guys
Criminal group operating the Bayrob malware and associated fraud and monetization activities.
Criminal group operating the Bayrob malware and associated fraud and monetization activities.
“one of the initial victims of the Bayrob Group”
“the three main men behind this Bayrob malware campaign”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | proxy chain | Explicit | 175 |
| outgoing | USES | Tor | Explicit | 175 |
| outgoing | USES | Jabber | Explicit | 175 |
| outgoing | USES | Off The Record | Explicit | 175 |
| outgoing | USES | AlphaBay | Explicit | 175 |
| outgoing | USES | directional Wi-Fi antenna | Explicit | 175 |
| outgoing | USES | custom flashed router | Explicit | 175 |
| outgoing | USES | LUKS | Explicit | 175 |
| outgoing | USES | TrueCrypt | Explicit | 175 |
| incoming | ATTRIBUTED_TO | Bayrob | Explicit | 175 |
| incoming | MEMBER_OF | Bogden Nicolescu | Explicit | 175 |
| incoming | MEMBER_OF | Tiberiu Danet | Explicit | 175 |
| incoming | MEMBER_OF | Radu Miclaus | Explicit | 175 |
Bayrob ATTRIBUTED_TO Bayrob Group
The episode presents Bayrob as the malware operated by the Bayrob Group, while describing the group as the criminals behind the fraud.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
Bayrob Group USES proxy chain
The Bayrob Group routed traffic through multiple infected machines and used those machines as proxy-chain hops to conceal its origin.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they would jump through multiple infected machines in multiple countries”
Bayrob Group USES Tor
The Bayrob Group used Tor as part of its layered routing and concealment infrastructure.
Explicit Confidence 99% · Brian Levine EP 175 Details
“they would go to Tor, then from Tor they would go through their proxy chain”
Bayrob Group USES Jabber
The attackers used Jabber to communicate with one another.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“I could tell these guys were talking over Jabber”
Bayrob Group USES Off The Record
The attackers used Off The Record encryption for their Jabber chats.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“they were using OTR, Off The Record, which does end-to-end encryption on all Jabber chats”
Bayrob Group USES AlphaBay
The Bayrob Group sold proxies and stolen credit-card information on AlphaBay.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“some of those proxies were sold on AlphaBay”
“which they then sold on AlphaBay as well”
Bayrob Group USES directional Wi-Fi antenna
The group used directional Wi-Fi antennas to connect to and steal neighboring Wi-Fi networks, helping conceal its actual locations.
Explicit Confidence 99% · Brian Levine EP 175 Details
“They would hack into another account in Bucharest”
“these large directional antennas”
Bayrob Group USES custom flashed router
Each member received a custom-flashed router that allowed the group to proxy traffic between different houses.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“each of them got a custom flashed router”
Bayrob Group USES LUKS
The group used LUKS to encrypt its Linux systems.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they were running Linux with LUKS on it”
Bayrob Group USES TrueCrypt
The group used multiple TrueCrypt containers to protect its work systems.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they had a couple of TrueCrypt containers on it”
Bogden Nicolescu MEMBER_OF Bayrob Group
Bogden Nicolescu, also called Masterfraud, is identified as one of the three main people behind the Bayrob campaign and as the group’s leader.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“There was Bogden Nicolescu, AKA Masterfraud”
“the head of the group”
Tiberiu Danet MEMBER_OF Bayrob Group
Tiberiu Danet, also called Amightysa, is identified as one of the three main people behind the Bayrob campaign.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“Tiberiu Danet, AKA Amightysa”
Radu Miclaus MEMBER_OF Bayrob Group
Radu Miclaus, also called Minolta and Raduspr, is identified as one of the three main people behind the Bayrob campaign.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“Radu Miclaus, AKA Minolta, AKA Raduspr”