Infraud Organization

Also known as: Infraud Organization, Operation “Shadow Web”

(Bank Info Security) The Infraud Organization ran an online forum dedicated to criminal activity that federal prosecutors claim had more than 10,000 members in March 2017. The site used the slogan ‘In Fraud We Trust,’ according to the Justice Department. The gang that operated Infraud engaged in a variety of identity theft and financial fraud from October 2010 to February 2018, prosecutors say. It’s believed to be responsible for the sale or purchase of over 4 million compromised payment card numbers during that time, according to the court filing. The aim of the organization was to develop the ‘premier online destination for the purchase and sale of stolen property and other contraband’ that also serves as the source of other contraband vendors, according to the Justice Department. The gang used advertising to direct web traffic from its website to other automated sites that were owned or operated by its members, helping other cybercriminals traffic in point-of-sale malware, banking Trojans, stolen payment card details and counterfeit identification, prosecutors say.

🌍 Country ["[Various]"]

Introduction

(Bank Info Security) The Infraud Organization ran an online forum dedicated to criminal activity that federal prosecutors claim had more than 10,000 members in March 2017. The site used the slogan ‘In Fraud We Trust,’ according to the Justice Department. The gang that operated Infraud engaged in a variety of identity theft and financial fraud from October 2010 to February 2018, prosecutors say. It’s believed to be responsible for the sale or purchase of over 4 million compromised payment card numbers during that time, according to the court filing. The aim of the organization was to develop the ‘premier online destination for the purchase and sale of stolen property and other contraband’ that also serves as the source of other contraband vendors, according to the Justice Department. The gang used advertising to direct web traffic from its website to other automated sites that were owned or operated by its members, helping other cybercriminals traffic in point-of-sale malware, banking Trojans, stolen payment card details and counterfeit identification, prosecutors say.

Activities and Tactics

Country of Origin: 🏳️ [“[Various]”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • FastPOS
  • FastPOS:

Attribution and Evidence

Country of Origin: [“[Various]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.