OurMine

Also known as: ATK 128, ATK128, OurMine, TAG-HA10

OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services. (Trend Micro) In light of the recent report detailing its willingness to pay US$250,000 in exchange for the 1.5 terabytes’ worth of data swiped by hackers from its servers, HBO finds itself dealing with yet another security breach. Known for hijacking prominent social media accounts, the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network. These include accounts for HBO shows, such as “Game of Thrones,” “Girls,” and “Ballers.” This is not the first time that OurMine has claimed responsibility for hacking high- profile social networking accounts. Last year, the group victimized Marvel, The New York Times, and even the heads of some of the biggest technology companies in the world. Mark Zuckerberg, Jack Dorsey, Sundar Pichai, and Daniel Ek — the CEOs of Facebook, Twitter, Google and Spotify, respectively — have also fallen victim to the hackers, dispelling the notion that a career in software and technology exempts one from being compromised.

🌍 Country ["Saudi Arabia"]

Associated Operations

2016-10 2016-12 2017-01 2017-04 2017-08 2017-09 2020-01 2020-02 Abu Dhabi Media Bears Bills Breach of DNS records of WikiLeaks Breach of Facebook's Twitter Breach of Nat Geo Photography’s Twitter account Breach of Netflix and Marvel Twitter accounts Breach of PlayStation social media accounts Breach of Twitter accounts of FC Barcelona and Real Madrid Breach of VEVO Breach of several Medium blogs Breach of several Twitter accounts affiliated with WWE Breach of the official Twitter accounts of FC Barcelona Broncos Browns Bucs BuzzFeed hacked by OurMine after it claimed to unmask one of its members Cardinals Chiefs Colts Cowboys Eagles Game of Thrones secrets revealed as HBO Twitter accounts hacked Giants Instragram Messenger's Twitter and Messenger's Instagram accounts OurMine crew hijacks social media accounts for the NFL Packers Sony Music Entertainment Texans Vevo WWE NXT WWE Network and Summer Slam Warner Music Group WrestleMania and Alphabet Inc. (Google’s parent company) and Vikings. and a couple of the documents reviewed by Gizmodo appear sensitive. https://fortune.com/2017/04/27/medium-ourmine-hack/ https://gizmodo.com/welp-vevo-just-got-hacked-1813390834 https://mashable.com/2017/01/29/wwe-accounts-twitter-hack-ourmine/ https://techcrunch.com/2016/12/21/ourmine-hacks-netflixs-u-s-twitter-account/ https://www.grahamcluley.com/despite-appearances-wikileaks-wasnt-hacked/ https://www.hackread.com/ourmine-hacks-nat-geo-photography-twitter-account/ https://www.theguardian.com/media/2017/aug/17/game-of-thrones-secrets-revealed-as-hbo-twitter-accounts-hacked https://www.theguardian.com/technology/2016/oct/05/buzzfeed-hack-ourmine-ahmad-makki-facebook-google https://www.welivesecurity.com/2017/08/21/hackers-target-playstation/ https://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/ https://www.welivesecurity.com/2020/02/17/fcbarcelona-twitter-account-hacked-again/ https://www.zdnet.com/article/hackers-deface-facebooks-official-twitter-and-instagram-accounts/ https://www.zdnet.com/article/hackers-hijack-twitter-accounts-for-chicago-bears-and-green-bay-packers/ including those of WWE Universe the 49ers the Olympics and the International Olympic Committee (IOC) the joint venture between Universal Music Group was just hacked. Roughly 3.12TB worth of internal files have been posted online wrestler and celebrity John Cena

Introduction

OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services. (Trend Micro) In light of the recent report detailing its willingness to pay US$250,000 in exchange for the 1.5 terabytes’ worth of data swiped by hackers from its servers, HBO finds itself dealing with yet another security breach. Known for hijacking prominent social media accounts, the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network. These include accounts for HBO shows, such as “Game of Thrones,” “Girls,” and “Ballers.” This is not the first time that OurMine has claimed responsibility for hacking high- profile social networking accounts. Last year, the group victimized Marvel, The New York Times, and even the heads of some of the biggest technology companies in the world. Mark Zuckerberg, Jack Dorsey, Sundar Pichai, and Daniel Ek — the CEOs of Facebook, Twitter, Google and Spotify, respectively — have also fallen victim to the hackers, dispelling the notion that a career in software and technology exempts one from being compromised.

Activities and Tactics

Country of Origin: 🏳️ [“Saudi Arabia”]

Notable Campaigns

  • 2016-10
  • 2016-12
  • 2017-01
  • 2017-04
  • 2017-08
  • 2017-09
  • 2020-01
  • 2020-02
  • Abu Dhabi Media
  • Bears
  • Bills
  • Breach of DNS records of WikiLeaks
  • Breach of Facebook’s Twitter
  • Breach of Nat Geo Photography’s Twitter account
  • Breach of Netflix and Marvel Twitter accounts
  • Breach of PlayStation social media accounts
  • Breach of Twitter accounts of FC Barcelona and Real Madrid
  • Breach of VEVO
  • Breach of several Medium blogs
  • Breach of several Twitter accounts affiliated with WWE
  • Breach of the official Twitter accounts of FC Barcelona
  • Broncos
  • Browns
  • Bucs
  • BuzzFeed hacked by OurMine after it claimed to unmask one of its members
  • Cardinals
  • Chiefs
  • Colts
  • Cowboys
  • Eagles
  • Game of Thrones secrets revealed as HBO Twitter accounts hacked
  • Giants
  • Instragram
  • Messenger’s Twitter and Messenger’s Instagram accounts
  • OurMine crew hijacks social media accounts for the NFL
  • Packers
  • Sony Music Entertainment
  • Texans
  • Vevo
  • WWE NXT
  • WWE Network and Summer Slam
  • Warner Music Group
  • WrestleMania
  • and Alphabet Inc. (Google’s parent company)
  • and Vikings.
  • and a couple of the documents reviewed by Gizmodo appear sensitive.
  • https://fortune.com/2017/04/27/medium-ourmine-hack/
  • https://gizmodo.com/welp-vevo-just-got-hacked-1813390834
  • https://mashable.com/2017/01/29/wwe-accounts-twitter-hack-ourmine/
  • https://techcrunch.com/2016/12/21/ourmine-hacks-netflixs-u-s-twitter-account/
  • https://www.grahamcluley.com/despite-appearances-wikileaks-wasnt-hacked/
  • https://www.hackread.com/ourmine-hacks-nat-geo-photography-twitter-account/
  • https://www.theguardian.com/media/2017/aug/17/game-of-thrones-secrets-revealed-as-hbo-twitter-accounts-hacked
  • https://www.theguardian.com/technology/2016/oct/05/buzzfeed-hack-ourmine-ahmad-makki-facebook-google
  • https://www.welivesecurity.com/2017/08/21/hackers-target-playstation/
  • https://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/
  • https://www.welivesecurity.com/2020/02/17/fcbarcelona-twitter-account-hacked-again/
  • https://www.zdnet.com/article/hackers-deface-facebooks-official-twitter-and-instagram-accounts/
  • https://www.zdnet.com/article/hackers-hijack-twitter-accounts-for-chicago-bears-and-green-bay-packers/
  • including those of WWE Universe
  • the 49ers
  • the Olympics and the International Olympic Committee (IOC)
  • the joint venture between Universal Music Group
  • was just hacked. Roughly 3.12TB worth of internal files have been posted online
  • wrestler and celebrity John Cena

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Hacking Team UEFI Rootkit
  • CyberGate
  • Cyber Eye RAT

Attribution and Evidence

Country of Origin: [“Saudi Arabia”] Additional attribution information pending cataloguing.

References

References pending cataloguing.