Cybercrime , Fraud Management & Cybercrime

An alleged moderator of the AlphaBay underground marketplace has been indicted for facilitating sales on the darknet site before law enforcement shut it down.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Bryan Connor Herrell, 24, of Colorado faces one count of conspiring to engage in a racketeer-influenced corrupt organization, according to the U.S. Attorney's Office for the Eastern District of California, which is overseeing the case. He is currently in custody, federal prosecutors say.

For several years, AlphaBay and Hansa were considered two of the world's largest underground markets for guns, illicit drugs, stolen identity information, credit card numbers and other illegal items, according to prosecutors. At one point, these darknet sites combined had 10 times as many sales as the notorious Silk Road marketplace, authorities say (see: Police Seize World's Two Largest Darknet Marketplaces).

All that ended in July 2017 when the FBI and Europol conducted raids on AlphaBay and Hansa, seized their domains and began investigating those who ran the forums.

Moderating on AlphaBay

Herrell, who went by the darnet names "Penissmith" and "Botah," allegedly worked as a moderator for AlphaBay, settling disputes between vendors and purchaser, according to the indictment that was unsealed June 20, according to the indictment. Herrell also worked as a "scam watcher" on the site, making sure users were not defrauded by others selling goods on the forum, the indictment alleges.

Herrell was paid in bitcoin for his services, according to the indictment.

If found guilty, he faces a maximum prison term of 20 years, according to federal prosecutors.

Long-Term Investigation

This indictment demonstrates yet again that law enforcement is willing to wait for several years to bring charges in these types of cases - even after the sites have been closed for long periods of time.

Earlier this month, for instance, federal prosecutors indicted four individuals on racketeering and other charges for their roles in developing and distributing malware through Darkode, another online forum for hackers that police closed four years ago (see: Feds Charge Four in New Darkode Case).

Popular Darknet Site

AlphaBay, which was launched in December 2014, at its height had more than 200,000 members and 40,000 vendors, according to law enforcement officials.

That changed on July 4, 2017, when AlphaBay was shuttered as a result of an operation called Bayonet that was led by the FBI and Drug Enforcement Agency.

As part of that raid, AlphaBay's top administrator, Alexandre Cazes, 26, was detained by police in Thailand. Cazes was later found dead in his jail cell, apparently after taking his own life (see: Darknet Marketplace AlphaBay Offline Following Raids).

When he was arrested by police in Thailand, investigators seized Cazes' laptop, which authorities said was open and left in an unencrypted state. Within the computer, police found passwords and passkeys for the AlphaBay site and its servers as well as the online identities of individuals associated with the site, prosecutors said.

After Cazes' death, authorities indicated that investigations into other former AlphaBay administrators and users would continue.

Other Charges

Since the 2017 raid, others associated with AlphaBay have faced charges for using the site for their illegal schemes.

In January 2018, the U.S. Justice Department announced that two men had been sentenced to serve about six years each in federal prison for using AlphaBay and other darknet marketplaces to sell drugs.

A federal judge sentenced Californian David Ryan Burchard, 40, to serve 80 months in prison, while Emil Vladimirov Babadjov, 33, who has both Bulgarian and U.S. citizenship, was sentenced to serve 70 months in prison (see: Bitcoin-Amassing AlphaBay Drug Barons Get US Prison Time).

Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime , Multi-factor & Risk-based Authentication

Iran is increasing its malicious cyber activity against the U.S, which could manifest in "wiper" attacks that render computers unusable, a top U.S. cybersecurity official said on Sunday.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

As a result, U.S. institutions should shore up their basic cybersecurity defenses, including using multifactor authentication, said Christopher C. Krebs, director of the Department of Homeland Security's Cybersecurity and Infrastructure Agency.

"Iranian regime actors and proxies are increasingly using destructive 'wiper' attacks, looking to do much more than just steal data and money," Krebs said. "These efforts are often enabled through common tactics like spear phishing, password spraying and credential stuffing. What might start as an account compromise where you think you might just lose data can quickly become a situation where you've lost your whole network."

One of the most devastating wiper attacks occurred against the oil giant Saudi Aramco in 2012. The malware, called Shamoon, disabled tens of thousands of workstations. U.S. officials blamed Iran for the attack.

Krebs' warning comes as tension between the U.S. and Iran has risen, both in the cyber and physical realms. Last year, President Donald Trump nixed an Obama-era agreement with Iran intended to curb its development of nuclear weapons. He also reinstated sanctions.

Earlier this month, the U.S. accused Iran of planting magnetic mines that damaged commercial Japanese and Norwegian shipping vessels sailing in the Persian Gulf. Then on Thursday, Iran fired a surface-to-air missile that destroyed an unmanned U.S. Global Hawk surveillance drone flying near the Strait of Hormuz.

Iran claims the drone was in its territory, although the U.S says it flew over international waters. Iran says it held off firing on a U.S. P-8 surveillance plane, which it claimed also entered its airspace.

The White House says it prepared a kinetic response to Iran's downing of the drone. But President Donald Trump reportedly called off the strike after learning it could kill up to 150 people. Trump said the response wouldn't be proportionate.

Report: US Digital Strike

But on Saturday, Yahoo News reported that the U.S. Cyber Command launched a retaliatory digital strike on an Iranian spy group that aided with the mine attacks.

The Washington Post subsequently reported that the attacks disabled the command-and-control systems Iran uses to control rocket and missile launches. The strike was aimed at the Islamic Revolutionary Guard Corps, which is part of Iran's military and which the U.S. designates as being a foreign terrorist organization.

Yahoo News reports that Iran is also capable of interfering with GPS navigation systems in drones and possibly ships. In 2011, Iran said it captured an RQ-170 Sentinel drone, which looks like a giant, flying wing, after a cyber operation.

Thomas Rid, a professor of strategic studies at Johns Hopkins University, writes on Twitter that there could be more to the Yahoo News story related to potential U.S. ship hacking.

"Big ships are hackable swimming networks - many connected devices, very bored users, little open pen-testing, likely change-averse admins, likely bad patching, likely bad air-gapping on the water, even navigation and other control systems likely hooked up to legacy boxes," he writes.

Formidable Hacking Power

Cybersecurity companies and the U.S. government have warned for years that Iran is a capable offensive operator.

The U.S. National Counterintelligence and Security Center put Iran in a basket of three countries - including China and Russia - that it labels as being "the most capable and active cyber actors tied to economic espionage and the potential theft of U.S. trade secrets and proprietary information."

In February, the Justice Department announced the indictment of four Iranians along with a former U.S. Air Force counterintelligence agent. The former servicewoman, Monica Witt, defected to Iran in 2013 (see: US Air Force Veteran Charged in Iran Hacking Scheme).

Witt is accused of aiding the Iranians in phishing campaigns by developing target packages, or batches of information that could be useful for social engineering victims. The campaigns sought to compromise the computers of U.S. intelligence agents.

Also on the Iran front, DHS issued an urgent warning in January over attacks that sought to modify domain name system records. Modifying those DNS records can allow for a range of attacks, including collecting account credentials and redirecting email traffic (see: DHS Issues More Urgent Warning on DNS Hijacking).

The computer security company FireEye wrote at the time that whoever was behind the DNS attack appeared to have a "nexus to Iran" based on older attack data. DHS gave government agencies 10 days to ensure their DNS settings were correct and that they'd enabled two-step verification on all accounts used to control DNS settings.