Threat actor
threat_actor:roman_seleznev
Also: Bulba, Track2, nCux, smaus1
Threat actor identified in the episode as the operator behind multiple carding websites and the theft and sale of payment-card data.
Threat actor identified in the episode as the operator behind multiple carding websites and the theft and sale of payment-card data.
“Roman was hacking into hundreds of restaurants and shops around the world, stealing credit cards, and selling them”
“nCux and Track2 and Bulba were all the same person”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | CarderWorld.cc | Explicit | 32 |
| outgoing | USES | Carder.su | Explicit | 32 |
| outgoing | USES | Bulba.cc | Explicit | 32 |
| outgoing | ASSOCIATED_WITH | Track2.name | Explicit | 32 |
| outgoing | USES | Liberty Reserve | Explicit | 32 |
| outgoing | DISCOVERED_BY | United States Secret Service | Explicit | 32 |
| outgoing | USES | Kameo | Uncertain | 32 |
| outgoing | USES | internet-wide scanning | Explicit | 32 |
| outgoing | USES | Credential brute force | Explicit | 32 |
| outgoing | EXPLOITS | Remote Desktop exposure | Derived | 32 |
| outgoing | TARGETS | RBS Worldpay | Attributed | 32 |
| outgoing | USES | Tor Browser | Explicit | 32 |
| incoming | OPERATED_BY | 2pac.cc | Explicit | 32 |
| incoming | INVOLVES | RBS Worldpay breach | Attributed | 32 |
| incoming | OPERATED_BY | Carder.su | Explicit | 32 |
Roman Seleznev USES CarderWorld.cc
The actor used CardingWorld.cc to advertise and sell stolen credit-card dumps under the alias nCux.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“nCux would come up on the forum and go crazy selling dumps.”
Roman Seleznev USES Carder.su
The actor used Carder.su under the alias Track2 as a card-dump vendor.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“a new vendor showed up there named Track2”
Roman Seleznev USES Bulba.cc
The actor used Bulba.cc as an elite carder marketplace for stolen cards.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“you can then be invited to Bulba.cc, a more elite carder site”
Roman Seleznev ASSOCIATED_WITH Track2.name
Track2.name was associated with Roman Seleznev through matching physical address, ICQ number, and account information; the episode presents this as connecting Track2 to Roman.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“nCux and Track2 and Bulba were all the same person”
2pac.cc OPERATED_BY Roman Seleznev
The Secret Service connected Roman Seleznev to being the person behind 2pac.cc.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“they found information that connected Roman Seleznev to be the person behind the 2pac.cc website”
Roman Seleznev USES Liberty Reserve
Roman used Liberty Reserve for financial transactions connected with his carding businesses.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“He found a lot of e-mails for transactions through Liberty Reserve”
Roman Seleznev DISCOVERED_BY United States Secret Service
The Secret Service discovered that the nCux identity was Roman Seleznev.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“they discovered his name was Roman Seleznev”
Roman Seleznev USES Kameo
The episode says Roman installed Kameo on exposed Windows computers to scrape payment-card data, although the episode also frames the attribution as presumptive in places.
Uncertain Confidence 90% · Jack Rhysider EP 32 Details
“he’d install malware on it to scrape the cards off it and then send it to his server”
“presumably by Roman Seleznev”
Roman Seleznev USES internet-wide scanning
Roman's server was used to mass-scan the internet for computers with Remote Desktop exposed.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“This server was being used to mass-scan the internet”
Roman Seleznev USES Credential brute force
After finding exposed Remote Desktop systems, the attacker attempted logins by cycling through commonly used usernames and passwords.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“attempt to brute force login to it by cycling through thousands of commonly-used usernames and passwords”
Roman Seleznev EXPLOITS Remote Desktop exposure
Roman exploited systems with Remote Desktop exposed to the internet, according to the episode's reconstruction of his activity.
Derived Confidence 94% · Jack Rhysider EP 32 Details
“Roman would hack into Windows computers that he would find exposed online”
RBS Worldpay breach INVOLVES Roman Seleznev
Federal prosecutors claimed Roman, along with fourteen others, hacked RBS Worldpay; Roman pleaded guilty to the charge.
Attributed Confidence 98% · Jack Rhysider EP 32 Details
“Federal prosecutors there claimed Roman, along with 14 other people, hacked into RBS Worldpay”
“Roman pleaded guilty to this, too.”
Carder.su OPERATED_BY Roman Seleznev
Roman pleaded guilty to being the owner of Carder.su, according to the episode.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“accused Roman of being the owner of Carder.su”
“Sure enough, it was true. Roman pleaded guilty to these charges”
Roman Seleznev TARGETS RBS Worldpay
The episode says Roman was accused of participating in the attack against RBS Worldpay.
Attributed Confidence 95% · Jack Rhysider EP 32 Details
“Roman was accused of stealing two million dollars himself.”
Roman Seleznev USES Tor Browser
Forensic analysis found that Roman's laptop was last used with a Tor browser.
Explicit Confidence 96% · Jack Rhysider EP 32 Details
“the last application he used was a Tor browser”