Profile Of A Cybercrime Petty Thief

Although the cybercrime game is dominated by organized criminals -- according to IBM X-Force, 80 percent of cyber attacks are driven by highly organized crime rings -- there are one-man operations getting a piece of the action, too. Trend Micro today proposed that actors like these may be the "evolved version of the petty thief," and profiled one individual operating in Canada.

This individual, who Trend Micro calls Frapstar, doesn't write code:  he buys it. He isn't very slick at hiding his tracks or identity. Yet he seems to make a comfortable living, either supplemented by or solely by selling dumps of credit card and Canadian passport data.

Frapstar also goes by the handles ksensei21 and badbullz across a variety of platforms, both criminal and non-criminal. He's active on multiple carding, PII exchange, and Russian hacking forums including vendors.es, proven.su, silverspam.net, lampeduza.so, damagelab.org, and exploit.in. 

"We even found him openly searching for conspirators on the public Internet," wrote the researchers, referencing a post in which Frapstar said "Need partner to make thing happen in canada region."

"This is clearly the mark of a one-man and relatively amateurish operation," according to Trend researchers, "most criminals that we track know better than to ask for conspirators, especially not in Canada — a large country with a small populace makes for an easy grid to track someone down."

Because he used the same handles across platforms, the researchers were able to discover that Frapstar is a fan of expensive cars, particularly BMWs. He gushed about his BMW 540i on a BMW forum, introducing himself as "Chuck" from Montreal, and providing his Gmail address.

"This finding gives a peek of what kind of lifestyle Frapstar has," the researchers wrote. "He is obviously living comfortably and is able to afford some luxuries. We are not certain whether Frapstar has a different day job that supplements his cybercrime operations, but we believe that he is earning a substantial amount from his operations."

While Bitcoins have become the preferred payment method of organized cybercriminals, Frapstar preferred Western Union or WebMoney.

His tradecraft of choice were all purchased on the black market from other cybercriminals, and included information stealers like ZeuS and Zbot, the VBNA Visual Basic worm, SillyFDC autorun worm, and a variety of scanners, passwrod stealers, droppers, downloaders, and backdoors. He also bought spamming and botnet services.

"His strategy, using multiple malware types resembles a Swiss Army Knife," the researchers said. "Frapstar purchases malware with different capabilities and used each depending on his current needs. This also highlights a key fact about the user: Frapstar is a script kiddie who shops for malware on hacking forums but also possesses enough know-how to effectively use the malware."

Trend Micro has reported Frapstar to Canadian authorities.