Read on Twitter
Open Source Research - Debunking Rewterz& #39; Claim of Discovering Telcos Data on the Dark Web
[Thread]
[Thread]
Rewterz published news on their website (10th April) that their & #39;Threar Intelligence Team& #39; discovered a dark web forum wherein a cyber criminal was offering to sell telcos data of 115 million Pakistanis for 300 BTC.
Source: http://archive.vn/XohkA ">https://archive.vn/XohkA&quo...
Source: http://archive.vn/XohkA ">https://archive.vn/XohkA&quo...
Initially, I didn& #39;t bother looking up the claim through open sources, assuming Rewterz may have indeed observed the data on a dark web forum (Note to Self for the Future: Never trust local & #39;cyber threat& #39; firms& #39; claims).
A basic reverse-lookup of the news mentions a post on a platform called & #39;Raid Forums& #39;, apparently a gathering place for pseudonymous merchants to buy/sell data from various countries.
This was the URL of the thread, which does not exist anymore (couldn& #39;t archive before it was removed).
Attached is a screenshot and a photo of an updated message from the data seller on Raid Forums, preserved by experienced technical analysts (this post has also been removed), h/t to & #39;Hackology& #39; and & #39;Ch Muhammad Osama& #39;.
Observations:
1. Data seller used pseudonym & #39;superposition& #39;.
2. Claimed that data is & #39;fresh& #39;, could not offer samples for verifying digital age.
3. Clarified that data is priced for BTC equivalent to USD 300, not 300 BTC.
4. Wanted to sell through a middleman to evade risks.
1. Data seller used pseudonym & #39;superposition& #39;.
2. Claimed that data is & #39;fresh& #39;, could not offer samples for verifying digital age.
3. Clarified that data is priced for BTC equivalent to USD 300, not 300 BTC.
4. Wanted to sell through a middleman to evade risks.
The & #39;superposition& #39; username redirects you to user & #39;TallyHo& #39;, who, despite making only a handful of posts, was designated & #39;VIP member& #39;. Clearly, & #39;superposition& #39; (data seller) has been shapeshifting, see my attached video. Archived copy of profile: http://archive.vn/tu0ta ">https://archive.vn/tu0ta&quo...
