Who Is the Network Access Broker ‘Wazawaka?’

https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/

by feross • 5 years ago

69 52 5 years ago

I never realized it was that involved. Ie that there are specialty roles in ransomware where people simply provide the access for a fee, and sell that to someone else to actually do the ransoming.

The other question of course is - can this be considered Russian sponsored if they choose not to ever prosecute? How does this end? It becomes a major career in Russia?

mistrial9• 5 years ago

To me it sounds gullible and one-dimensional to use the name of some far-away place with a different language system, to blame for every criminal or autocratic problem. Mafia in the USA runs health care and show girls -- poor idiots far away sell hijack tools.

There are smart people in every country, of every color and language.

actusual• 5 years ago

I'm curious now...got any source for you "Mafia in the USA runs health care and show girls" statement?

Nextgrid• 5 years ago

I wouldn't be surprised if devices typically become compromised via automation - the ones responsible may not have the expertise & manpower needed to develop & deploy viable ransomware payloads, negotiating ransoms, providing "tech support" to "customers" who choose to pay the ransom and need help decrypting, etc. So they'd rather resell the access for a flat fee and leave it to others to milk out the actual targets for potentially more money. The low but steady stream of money they get might also be easier to launder than ransoms worth hundreds of thousands.

I doubt this is limited to ransomware - I bet customers of a "network access broker" would involve conventional malware such as spam/DoS bots, ad fraud, etc as well.

kgeist2• 5 years ago

The other question of course is - can this be considered Russian sponsored if they choose not to ever prosecute?

Here Russian police is lazy - if no one files a complaint, they won't do anything. Since he avoids targetting Russian organizations, law enforcement is probably completely unaware of him. Something can happen if American law enforcement contacts Russian law enforcement directly but it looks there's little cooperation there because of the mutual political animosity between USA & Russia (US/Russian embassies getting closed, ties being cut etc) I wonder what will happen if Interpol gets involved

bellyfullofbac2• 5 years ago

I wonder if he's ever stolen from a powerful drug dealer, who could afford to send someone to Russia to get revenge - not necessarily show up at the hacker's door, but to rent some locals who'd do that

IAmGraydon• 5 years ago

Russia is an Interpol nation, so they should be able to operate there. It's amazing to me that someone this high profile and careless hasn't already been arrested, though. Perhaps there is some kind of protection in place.

ivan_gammel3• 5 years ago

This publication seems to be a major violation of privacy in several jurisdictions. Regardless of whether this guy is a criminal and whether his relative is complicit, their personal details should not be published in any form that is not an arrest order by law enforcement. Now not only their private information is disclosed, but they also can become targets for other criminals (he is probably a rich person and unless he is a member of some offline syndicate, e.g. FSB, he can be a subject for kidnapping and extortion). If the purpose of the publication is to put him in the spotlight, I do not see how those cybersecurity researchers are different from him.

antihero• 5 years ago

Also there’s the fact that if you were going to do some serious cybercrime, it would make sense to leave a bunch of hard to find but still findable trails to a real person that isn’t you, so it could be a frame up!

bellyfullofbac2• 5 years ago

For extra clever points, make it a person who already does protect their privacy by e.g. encrypting everything on local storage, doesn't like the cloud, and not being all over social media. If the cops bust them and can't find any evidence, they'll accuse them of hiding things, if they comply and decrypts their stuff and there's still nothing, the cops will still insist it was this person and they're still hiding something. If there's other incriminating stuff in the encrypted disks, boom the cops will bust them for that instead and will still think they got the master hacker...

bennyp101• 5 years ago

That was my first thought when he mentioned the Skype handle being a relative, "perhaps even his sister" - that seems like it crosses the line.

If he has been stealing money from drug dealers etc, then outing his (potential) family - or worse, someone being fitted up - could have very bad repercussions.

renewiltord• 5 years ago

Live by the sword, die by the sword.

sam_lowry_3• 5 years ago

Civil protest is often associated with privacy violations.

Belarusians that had to flee the country after August, 2020 set up a whole website where they meticulously map all those involved in stealing elections and beating protestors, see http://blackmap.org/

They even publish addresses of people who deliberately reported protestors to the authorities, together with the report summaries.

In a society run by bandits, violating privacy to expose their deeds is not even a lesser evil but a moral obligation.

Also, how is the work of Brian different from the work of Bellingcat or Navalny Team? Both are prased by media. So is Brian.

I have an answer: Privacy is a luxury, not a right. In peaceful times an democratic societies everyone can have some privacy.

When people starve to death, get beaten or killed while others amass riches, privacy means little in the face of defiance, hate and revenge.

pphysch5• 5 years ago

You seem to be implying that Bellingcat/Navalny aren't proven hucksters and info-mercenaries who will say anything to keep their moneyed interests happy.

At least Brian is a plausibly independent (from powerful governments) blogger who occasionally publishes some high-signal, low-noise content. Although this sort of doxxing is out of hand even if Russians are "fair game" to his Western audience.

flerchin• 5 years ago

Wazawaka could probably sue. She probably won't.

ahofmann2• 5 years ago

Brian Krebs regularly publishes articles in which he reveals people's private data. I don't think that's okay either, but Brian is often celebrated for it and will continue to do so. I used to enjoy reading krebsonsecurity.com, but since I realized that he is blatantly vigilante with these articles, I avoid the site. His argumentation is that he would only doxx criminals. However, this is not true, a few years ago he doxxed the developer of a large German imageboard and many volunteers of the imageboard, who wanted to remain anonymous for good reason. The criticized software of the developer had nothing to do with the imageboard and the developer also communicated that with Brian, but he didn't care about all that. The main thing was to sell the story well for him.

Brian Krebs, if you read this: a hearty "fuck you" from me for this action! You started something, that in the end destroyed one of the last places on the Internet, where one could still talk undisturbed. In my opinion, you are the biggest scum of all.

shadowgovt• 5 years ago

Which image board?

Ansil8495• 5 years ago

Brian Kreb has a history of doxing essentially anyone he doesn't like. He literally once doxed someone whose crime was leaving a negative review of his book [1]. That kind of behavior is not OK, full stop.

What I think has happened is Krebs has spent too much time immersed in online troll culture, to the point where he now acts exactly like the people he writes about.

[1] https://itwire.com/images/authors-images/samvarghese/krebs_d...

f38zf5vdt• 5 years ago

I can't imagine law enforcement or intelligence has a favourable opinion of him either. This sort of vigilantism tips off cybercriminals to the fact that someone is on their trail and causes them to become proactive about moving themselves outside of any place they could be arrested. By publishing this information it leads FSB recruiters to cybercriminals while at the same time ensuring they stay within Russian soil where extradition treaties do not exist, meaning they will never be brought to trial.

stickfigure5• 5 years ago

This wasn't just "someone whose crime was leaving a negative review of his book". From that image you posted, quoting Krebs: The guy is a convicted cybercrook who's in jail. Of course he hates me

Omitting that fact is incredibly misleading. For the record, I'm pretty ok seeing the crook's CV posted.

tryauuum• 5 years ago

I wonder if author can speak Russian. If not and he is armed only with google translate then it's an even more impressive investigation.

alwayseasy• 5 years ago

He learned to speak Russian just for his job. Couldn't infiltrate those forums otherwise.

YarickR2• 5 years ago

Well, something doesn't add up. "The phone number tied to that Vkontakte account — 7617467845 — was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia." This number looks bogus, mobile phone numbers in Russia are +7(three digit provider code)(seven digits of actual number); given number is one digit short. We could assume this number is (three digit provider code)(seven digits of actual number) , but there's no provider with code 761 in Russia.

orthoxerox• 5 years ago

The provider code should start with a 9 for mobile phones. So 7-961-746 and so on

notreallyserio• 5 years ago

Seems like typical doxing behavior, posting inaccurate information for the mob. This Krebs guy sounds like a pos.

homo_nullius• 5 years ago

Looks like a simple typo (missing a 9 after the first 7). Later in the article the full number is listed.

sour-taste• 5 years ago

Is Krebs trying to claim the $5 million bounty on information leading to darkside affiliates arrest that he mentions in the post?

pelagicAustral• 5 years ago

Yeah, all they need to do now is send an inception team to convince Putin to extradite him to the states.

Muromec• 5 years ago

Which is prohibited by constitution.

jeroenhd• 5 years ago

Here we go again. Hopefully the person Krebs is doxxing is actually the real culprit this time.

Who Is the Network Access Broker ‘Wazawaka?’

Related Stories