Express Computer
Home  »  Security  »  Hacker made $1.5mn by selling backdoor access of 135 top firms

Hacker made $1.5mn by selling backdoor access of 135 top firms

0 315

A most notorious hacker attacked at least 135 companies in 44 countries, some even Fortune 500 ones, and made over $1.5 million by selling backdoor access of corporate networks on the Dark Web.

Cybersecurity firm Group-IB that works out from Singapore and Moscow, tracked the hacker for over three years and has now revealed his identity in a report titled “The invisible God of networks” who sold backdoor access to corporate networks on underground forums and even hired a sales manager to deal with the corporates.

The hacker that goes by the name “fxmsp” and who exploited remote desktop communications turned out to be Andrey A Turchin from Almaty, Kazakhstan.

“fxmsp” was seen on underground forums since 2016 but first announced his services in October 2017 with an offer of full access to critical network segments of a handful of unrelated organizations.

“It is believed that he had established backdoor access at a number of companies long before that, but took some time in figuring out how to monetize this access and initially attempted to use it to mine cryptocurrency,” reports CPO Magazine.

His most lucrative period of selling backdoor access was from August to November 2018. Light industry, IT and retail were the most common targets.

“He claimed to have compromised three different antivirus systems (believed to be McAfee, Symantec, and Trend Micro) along with about 60 new companies. ‘fxsmp’ raked in $1,100,800 during this period,” said the researchers.

He then disappeared with his sales manager called Lampeduza.

The duo resurfaced again offering their services between May and September 2019, offering access to a collection of 22 companies and making about $124,100.

Lampeduza confirmed in a December 2019 forum post that “fxsmp” had gone out of business.

“The customers were allowed to trial the backdoor access for a few hours, with the money held in an escrow account during that time”.

The hacker exploited open remote desktop protocol (RDP) ports, particularly the “3389” port commonly used to allow remote access to Windows servers and workstations.

According to the cybersecurity researchers, “fxmsp” is no longer publicly active.

“It remains uncertain, however, whether he is still breaking into company networks and selling access to them,” they said.

The report showed how fxmsp’s cybercriminal career evolved from a newbie hacker to one of the major players of the Russian-speaking underground.

Get real time updates directly on you device, subscribe now.

Leave A Reply

Your email address will not be published.

LIVE Webinar

Digitize your HR practice with extensions to success factors

Join us for a virtual meeting on how organizations can use these extensions to not just provide a better experience to its’ employees, but also to significantly improve the efficiency of the HR processes
REGISTER NOW 
India's Leading e-Governance Summit is here!!! Attend and Know more.
Register Now!
close-image
Attend Webinar & Enhance Your Organisation's Digital Experience.
Register Now
close-image
Enable A Truly Seamless & Secure Workplace.
Register Now
close-image
Attend Inida's Largest BFSI Technology Conclave!
Register Now
close-image
Know how to protect your company in digital era.
Register Now
close-image
Protect Your Critical Assets From Well-Organized Hackers
Register Now
close-image
Find Solutions to Maintain Productivity
Register Now
close-image
Live Webinar : Improve customer experience with Voice Bots
Register Now
close-image
Live Event: Technology Day- Kerala, E- Governance Champions Awards
Register Now
close-image
Virtual Conference : Learn to Automate complex Business Processes
Register Now
close-image