Dark Basin DISCOVERED_BY Citizen Lab
Citizen Lab investigated the phishing infrastructure and named the hacking group Dark Basin.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“Dark Basin was what Citizen Lab named this hacking group.”
Threat actor
threat_actor:dark_basin
Name given by Citizen Lab to a large hack-for-hire hacking group conducting targeted phishing and account-compromise operations.
Name given by Citizen Lab to a large hack-for-hire hacking group conducting targeted phishing and account-compromise operations.
“Dark Basin was what Citizen Lab named this hacking group.”
“This looks mercenary.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Citizen Lab | Explicit | 79 |
| outgoing | USES | phishing | Explicit | 79 |
| outgoing | USES | Credential phishing | Explicit | 79 |
| outgoing | USES | URL shortener | Explicit | 79 |
| outgoing | SAME_AS | Mercenary.Amanda | Explicit | 79 |
| outgoing | ASSOCIATED_WITH | India | Uncertain | 79 |
| outgoing | ASSOCIATED_WITH | BellTroX InfoTech Services | Uncertain | 79 |
Dark Basin DISCOVERED_BY Citizen Lab
Citizen Lab investigated the phishing infrastructure and named the hacking group Dark Basin.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“Dark Basin was what Citizen Lab named this hacking group.”
Dark Basin USES phishing
Dark Basin sent phishing links to victims in crafted emails.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“E-mails were sent to victims with phishing links in them”
Dark Basin USES Credential phishing
The phishing sites used by Dark Basin requested victims’ login credentials, including email passwords.
Explicit Confidence 99% · Adam Hulcoop EP 79 Details
“the phishing site you land on knows who is coming and they can pre-load that text and pre-load that screen to make it look like – you’ve already been signed into your Gmail; just re-enter your password for us.”
Dark Basin USES URL shortener
Dark Basin used URL shorteners created with open-source software to conceal phishing destinations.
Explicit Confidence 98% · Adam Hulcoop EP 79 Details
“we found some suspicious links that were shortened using a URL shortener”
Dark Basin SAME_AS Mercenary.Amanda
The episode presents Mercenary.Amanda as another name used by NortonLifeLock for the group Citizen Lab called Dark Basin.
Explicit Confidence 94% · Jack Rhysider EP 79 Details
“they were also tracking Dark Basin, but they called this group Mercenary.Amanda”
Dark Basin ASSOCIATED_WITH India
The timing, code, URL-shortener names, logs, and test IP addresses were suggestive of operators working out of India, but the episode notes that the timezone could have been falsified.
Uncertain Confidence 84% · Adam Hulcoop EP 79 Details
“each piece was another little bread crumb suggesting operators working out of India”
Dark Basin ASSOCIATED_WITH BellTroX InfoTech Services
The episode presents circumstantial evidence linking Dark Basin’s phishing activity to BellTroX InfoTech Services, rather than asserting a fully proven operational identity.
Uncertain Confidence 86% · Jack Rhysider EP 79 Details
“He was relieved when the Citizen Lab report came out linking the phishing to BellTroX”