Welcome back everybody. My name is Steve Reagan. I'm joined by live rally from flashpoint. We're going to talk about the Spanish underground
We'll be right back
And welcome back to salted hash as I said, my name is Steve Reagan senior staff writer at CSO online
i'm joined by live rally a analyst from flashpoint and I am
filming and I've been out here at RSA all week long and
One of the things you hear when you walk around the show floor is people talking about
the darknet the dirt with the the frightening hidden place that everybody knows about but knows absolutely nothing about and
it's really easy to make fun of the hype and the spin that goes into that but at the same time it's it's one of
Those things to where it's a real credible threat, it's something you do need to be aware of
But your research has taken you down some interesting paths now as I understand it
You've been watching the Spanish underground, correct? Yeah, tell me a little bit about that. So the Spanish underground to me is really unique because
Everyone everyone loves talking about the Russians cyber criminals and Chinese cyber crime
But Spanish cybercrime is to me a very distinct and even when people talk about Latin Americans cybercrime
They tend to talk about Brazilian and Brazilians speak Portuguese. So this is a completely distinct cyber criminal community a distinct linguistic community
That's often overlooked
So what I think is really cool about it. And this is what my presentation on Friday is going to be about
it's a very
It's an incredibly unstable
Underground right forums go up. They go down. They they lose user information. Like it's very unstable
It's very unpredictable, but it's highly persistent
so even though you may have like the top forum go offline and nobody really knows why I
There are other forms that people can move to and keep talking so that dark net cyber criminal activity is yeah
It's persistent it can keep it can keep happening. So
So then compare and contrast here when you look at
The Eastern European forums and some of the hots it's mostly straight malware development
Buy sell trade stolen Fred's you've got phishing kids and their dev exploit kids. How does the Spanish market differ?
so the Spanish market is
significantly less sophisticated
Technically and it tends to rely more on the social so more on deceiving victims
So you mentioned fishing kits. We don't really see fishing kits often on the Spanish underground
But we'll see lots of fishing pages, right? Like that's that's more where they are
So we see a lot of that online carding. So using compromised credit cards to buy goods online
there's a ton of online carding that we
Owe you
That's exactly it. Yeah, and I I think that's interesting because you don't really need to be
Sophisticated to make money in in, you know Latin America
especially the Spanish speaking parts because there's such low security awareness a lot of times so people
They don't know how to protect themselves. So they very can easily become victims of crime and fraud and
Yeah, if your victim base can easily fall for having their their credit card information stolen
Why why would you do like the academic pursue of learning to write malware, right? So what are some of the
Standout scams, like they're really common ones that you're seeing that are highly effective for them
Like they keep going back to so one thing. We see a lot of I was mentioning the online carding
We see a ton of that and they actually call that Kumba's so which is just like AI
purchases and Spanish is what it translates to but it has the
the implications that their carded but it's interesting because what people will do people who are experienced in carding goods online is they will actually
Offer their services to other people so they'll say like hey I can get you anything from this site. Come to me
I will buy it for you with a compromised card and you just pay me
30% of what it actually cost. So we said we see a good amount of people offering those services targeting different
Stories either within Latin America or some us-based stores or European based stories, though
That's it's very interesting. So when
I'm sorry, I'm stuck on this whole you've got the middleman
I mean the middleman thing was what you saw in the Eastern European phones like years ago
Mm-hmm. There's a lag. Yeah
they came up and now it's like so are there any any
like limits or any kind of drawbacks
Like are there things that you won't see them touch when you're investigating these forms or the crimes?
They just won't go near or is anything game if it's a good awesome?
So I I guess the answer would be anything would be game
There's not the kind of like code of conduct that the the Russian side or russian-speaking cyber criminals may have about like not targeting others
Yeah, yeah. Yeah, you don't there's not that but again, there's not really
A drive to become more sophisticated and actually one thing that we have seen is when we do identify some more
technically advanced actors in the Spanish language space
They often will move on into either English language communities or Russian language communities
Because they're not finding a market for what they're trying to sell people just aren't willing to invest paying
You know hundreds of dollars or thousands of dollars to buy a loader or malware something because they don't need to make the investment
Yeah, so those people often move into other spaces to try to make the sale there. How often do you see that?
We're a sophisticated actor or show up. Yeah that all that then has to evolve
We don't see that terribly often. I but we have identified like a couple cases of that happening
Have you noticed any kind of trends in like?
Reports of crimes in a given area of the country versus what you're seeing on the forums. So like carding or you know, like lost
Gift cards, so to see a rash of gift card threats or something like that translated into a spike on the phone
Yeah
so one thing that I've seen that that I think is really cool and we saw some media reporting coming out of I
Believe it was Nicaragua about fake coal centers. I never heard of this before
They're literally just it's a call center. It is staffed by people
It has equipment and it is just designed for fraud everyone
there is just calling up people being like hey like you won the lottery like give me some information and
Yes, so we were seeing that
Coming out and some of the media reporting and I was like, okay, this is super weird
let me let me see what I can find and we were actually able to identify a couple people saying like
Like I run a call center I get compromised cards this way
So that I was cool and then also finding like some more of the decide stuff that would support a fraudulent call center
So like people selling like a list of phone numbers and stuff like that. I
Mean you
It's a solid hustle. Yeah, it's a straight solid hustle. So what advice do you have for?
Anyone who's really concerned about those types of frauds?
Is there anything people can do to have a little bit their exposure to that or is it because they're so basic hustles?
Yeah, I think having an awareness
If is like the biggest thing honestly because I think a lot of people don't
They're not really thinking about Latin American cybercrime
so if you think at all that like your company your partner's your subsidiaries your clients your employees like might be
Interacting with this space like start thinking creatively like, okay like we do have a subsidiary in Mexico
Like let's see, like what's their security actually look like how are they dealing with this or like, okay
we have like a whole team based in Argentina, like what type of
You know phishing links might they be clicking on like how should we be addressing these problems?
So I would honestly just like argue awareness and then moving from there when you identify like what your exposure is for that space
working with that
so if anybody wanted to keep up on
Your work or your research we find you
So my research is in a couple different places, but most of it you will find on the flashpoint blog
All right, that's good enough. Thanks again for joining us. Once again. This has been salted hash and I'm your host Steve very good
I'm out here filming all week long. So we'll see you next time
You