Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

In 2020, the United States brought charges against four men accused of building a bulletproof hosting empire that once dominated the Russian cybercrime industry and supported multiple organized cybercrime groups.
The Spamdot admins went by the nicknames Icamis, and Salomon.
Icamis and Sal were in daily communications with these botmasters, via the Spamdot forum and private messages.
The identity and whereabouts of Icamis have remained a mystery to this author until recently.
For years, security experts - and indeed, many top cybercriminals in the Spamit affiliate program - have expressed the belief that Sal and Icamis were likely the same person using two different identities.
In 2010 Spamdot and its spam affiliate program Spamit were hacked, and its user database shows Sal and Icamis often accessed the forum from the same Internet address - usually from Cherepovets, an industrial town situated approximately 230 miles north of Moscow.
It was common for Icamis to reply when Spamdot members communicated a request or complaint to Sal, and vice versa.
Still, other clues suggested Icamis and Sal were two separate individuals.
That story mentioned Rescator's real-life identity was exposed by Icamis in April 2013, as part of a lengthy farewell letter Ika wrote to Spamdot members wherein Ika said he was closing the forum and quitting the cybercrime business entirely.
To no one's shock, Icamis didn't quit the business: He just got a lot more quiet and circumspect about his work, which increasingly was focused on helping crime groups siphon funds from U.S. bank accounts.
GENTLEMEN SCAMMERS. Icamis and Sal offered a comprehensive package of goods and services that any aspiring or accomplished spammer would need on a day-to-day basis: Virtually unlimited bulletproof domain registration and hosting services, as well as services that helped botmasters evade spam block lists generated by anti-spam groups like Spamhaus.org.
Long-term partnerships with several in several parts of the world for any topic- your own data center and full legal support- realtime backups to neutral sites- guarantees and full responsibility for the services provided- non-standard equipment on request- our own admins to resolve any technical issues- hosting is also possible.
Ssl certificates signed by geotrust and thawte- old domains- beautiful domains- domains with indicators- making unstable gtld domains stable- interception and hijacking of custom domains- full domain posting via web.
Icamis and Sal frequently claimed that their service kept Spamhaus and other anti-spam groups several steps behind their operations.
In 2020, Grichishkin was arrested outside of Russia on a warrant for providing bulletproof hosting services to cybercriminal gangs.
ICAMIS, THE PHANTOM GRADUATE. The identity of Icamis came into view when KrebsOnSecurity began focusing on clues that might connect Icamis to Cherepovets.
Icamis promoted his services in 2003 - such as bulk-domains[.
I can register bulletproof domains for sites and projects advertised by spam(of course they must be legal).
To bring this full circle, Icamis was Andrey Skvortsov, the other Russian man charged alongside Grichiskin.
The government says Ika and Sal's bulletproof hosting empire provided extensive support for a highly damaging cybercrime group known as the JabberZeus Crew, which worked closely with the author of the Zeus Trojan - Evgeniy Mikhailovich Bogachev - to develop a then-advanced strain of the Zeus malware that was designed to defeat one-time codes for authentication.


This Cyber News was published on krebsonsecurity.com. Publication date: Mon, 08 Jan 2024 18:05:29 +0000


Cyber News related to Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell - In 2020, the United States brought charges against four men accused of building a bulletproof hosting empire that once dominated the Russian cybercrime industry and supported multiple organized cybercrime groups. The Spamdot admins went by the ...
11 months ago Krebsonsecurity.com
Cisco Duo and ISE: Better together in the cybersecurity battlefield - Luckily for you, Cisco Duo and ISE are the perfect pair to protect your network. Think of Cisco Duo's multi-factor authentication as the added layer of security that verifies a user's identity at the time of login, like a high-tech forcefield that ...
1 year ago Feedpress.me
Ten Years Later, New Clues in the Target Breach - On Dec. 18, 2013, KrebsOnSecurity broke the news that U.S. retail giant Target was battling a wide-ranging computer intrusion that compromised more than 40 million customer payment cards over the previous month. Ten years later, KrebsOnSecurity has ...
1 year ago Krebsonsecurity.com
The Persistent Danger of Remcos RAT - From initial infection to persistent control, the Remcos RAT campaign exemplifies the evolving nature of cyber threats and the need for proactive defense measures. This ecosystem is supported by a diverse array of servers that function as command and ...
11 months ago Cyberdefensemagazine.com
Police arrest four suspects linked to LockBit ransomware gang - Previous arrests of Lockbit ransomware actors (some of them already charged for various offenses) include Mikhail Pavlovich Matveev (aka Wazawaka) in May 2023, Artur Sungatov and Ivan Gennadievich Kondratiev (aka Bassterlord) in February 2024, and ...
2 months ago Bleepingcomputer.com
CVE-2020-26205 - Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view. ...
4 years ago
CVE-2021-1492 - The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an ...
3 years ago
CVE-2020-3483 - Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being ...
4 years ago
CVE-2021-26253 - A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO ...
2 years ago
CVE-2023-48692 - Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components ...
1 year ago Tenable.com
CVE-2023-48691 - Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected ...
1 year ago Tenable.com
CVE-2023-48316 - Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components ...
1 year ago Tenable.com
CVE-2023-48315 - Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components ...
1 year ago Tenable.com
Hackers push USB malware payloads via news, media hosting sites - A financially motivated threat actor using USB devices for initial infection has been found abusing legitimate online platforms, including GitHub, Vimeo, and Ars Technica, to host encoded payloads embedded in seemingly benign content. The attackers ...
10 months ago Bleepingcomputer.com
CVE-2012-4268 - Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_ACCEPT_ENCODING header. ...
7 years ago
Spamhaus Blocklist listings are moving - Any abuse desk worker or Trust and Safety team member who has received a Spamhaus Blocklist email notification, can view the full details of the listing on www. If you're not familiar, the SBL is a list of IP addresses that Spamhaus Project ...
11 months ago Spamhaus.org
Securing Your CentOS Web Panel to Prevent RCE Exploitation - Data security is essential for all web applications, particularly those hosting sensitive information. When it comes to protecting against remote code execution (RCE) exploitation, it is important to understand the inherent vulnerabilities of the ...
1 year ago Securityaffairs.com
CVE-2007-6496 - Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and ...
6 years ago
It's not cricket! Sri Lanka and Bangladesh co-host phishing attack - Sri Lanka and Bangladesh have a successful history of co-hosting the Cricket World Cup, but today the two countries' governments have found themselves on a sticky wicket by co-hosting a phishing attack that targets UK banking customers. Victims lured ...
1 year ago Netcraft.com
Tietoevry ransomware attack causes outages for Swedish firms, cities - Finnish IT services and enterprise cloud hosting provider Tietoevry has suffered a ransomware attack impacting cloud hosting customers in one of its data centers in Sweden, with the attack reportedly conducted by the Akira ransomware gang. Tietoevry ...
11 months ago Bleepingcomputer.com
CVE-2022-29836 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse ...
2 years ago
CVE-2023-20123 - A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain ...
1 year ago
CVE-2022-36329 - An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices.This issue affects My Cloud Home and My ...
1 year ago
CVE-2022-36330 - A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require ...
1 year ago
CVE-2022-36328 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device ...
1 year ago

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)