Malwarebytes Unpacked

High Exposure

exposure

Bill Gates is the latest victim of a series of hacks targeting celebrities and getting their private information exposed to the world. A group of hackers who already published Social Security Numbers, Credit Reports and banking details, addresses etc. for several other high profiles, is still enjoying an undisrupted run.

Equifax recently confirmed being breached which certainly gives more credibility to the story that is currently unfolding. While the U.S Secret Service is currently investigating the matter, even US President Obama commented on these incidents.

bill

Here is what we know so far:
• The website hosting this information is using the CloudFlare service.
• Its TLD (Top Level Domain name) is .su which stands for Soviet Union.

homepage

The site is getting a lot of traffic if you believe its counter:

counter1

A couple of minutes later:

counter2

We will not disclose the site’s URL but given the information posted and the recent report from Equifax we are taking it seriously. Identifying the perpetrators and their origin might prove difficult but it is certainly puzzling that the site has not been shut down yet.


About the author:
Jerome Segura is a Senior Security Researcher at Malwarebytes with experience in both client and server side malware with a focus on web exploits research. He has built high interaction honey-clients to capture drive-by download attacks and has performed hundreds of web server remediations for infected WordPress and Joomla! sites.
Follow him on Twitter: @jeromesegura

Follow Us