Dark Basin

Dark Basin is a hack-for-hire group, discovered in 2017 by Citizen Lab. They are suspected to have acted on the behalf of companies such as Wirecard and ExxonMobil.

Background

In 2015, Matthew Earl, a managing partner at ShadowFall Capital & Research, began to study Wirecard AG hoping to short sell them. Wirecard had just announced the purchase of Great Indian Retail Group for $254 million, which seemed overpriced to Earl. In February 2016, he started to write publicly about his discoveries under the alias Zatarra Research & Investigations, accusing Wirecard of corruption, corporate fraud, and money laundering.

Soon after, the identity of Zatarra Research & Investigations was revealed online, along with surveillance pictures of Earl in front of his house. Earl quickly realized that he was being followed. Employees from Jones Day, a law firm representing Wirecard, came to visit Earl and gave him a letter, accusing him of collusion, conspiracy, defamation, libel, and market manipulation. Earl also started to receive targeted phishing emails, appearing to be from his friends and family members. In the spring of 2017, Earl shared those emails with Citizen Lab, a research laboratory specializing in information control.

Citizen Lab's investigation

Initial findings

Citizen Lab discovered that the attackers were using a custom URL shortener that allowed enumeration, giving them access to a list of 28,000 URLs. Some of those URLs redirected to websites looking like Gmail, Facebook, LinkedIn, Dropbox or various webmails – each page customized with the name of the victim, asking the user to re-enter their password.

Citizen Lab baptized this hacker group 'Dark Basin' and identified several clusters among the victims:

* American environmental organizations linked to the #ExxonKnew campaign: Rockefeller Brothers Fund, Climate Investigations Center, Greenpeace, Center for International Environmental Law, Oil Change International, Public Citizen, Conservation Law Foundation, Union of Concerned Scientists, M+R Strategic Services or 350.org
* US media outlets
* Hedge funds, short sellers and financial journalists
* International banks and investment firms
* Legal firms in the US, UK, Israel, France, Belgium, Norway, Switzerland, Iceland, Kenya, and Nigeria
* Petroleum and energy companies
* Eastern European, Central European and Russian oligarchs
* Well-resourced people involved in divorces or other legal matters

The variety of targets made Citizen Lab think of a mercenary activity. The research laboratory confirmed that some of these attacks were successful.

Links to India

Several clues allowed Citizen Lab to assert ''with high confidence'' that Dark Basin was based in India.

Working hours

Timestamps in Dark Basin phishing emails were consistent with working hours in India, which has only one timezone: UTC+5:30.

Cultural references

The instances of the URL shortening service used by Dark Basin had names related to Indian culture: Holi, Rongali and Pochanchi.

Phishing kit

Dark Basin let their phishing kit source code, including some log files, available online. The source code was configured to print timestamps in India's timezone. The log file, that showed some testing activity, included an IP address based in India.

Links to BellTroX

Citizen Lab believes with high confidence, that BellTroX, also known as BellTroX InfoTech Services and BellTroX D, G, TAL Security, is the company behind Dark Basin. BellTroX, a Delhi-based company, advertises on its website doing activities such as penetration testing, certified ethical hacking, and medical transcription. BellTroX employees are described as noisy and were often posting publicly about their illegal activities. BellTroX's founder Sumit Guptra has been previously indicted and charged in the United States for a hack-for-hire scheme on the behalf of ViSalus.

BellTroX used the CV of one of their employees to test Dark Basin's URL shortener. They also publicly posted screenshots of links to Dark Basin's infrastructure.

Hundreds of people, working in corporate intelligence and private investigation, endorsed BellTroX on LinkedIn. Some of them are suspected to be possible clients. Those endorsements included a Canadian government official, an investigator at the US Federal Trade Commission, law enforcement officers and private investigators with prior roles in the FBI, police, military and other branches of government.

On June 7, 2020, BellTroX took down their website. In December 2021, Meta (Facebook) banned BellTroX as a "cyber-mercenary" group.

Reactions

Both Wirecard and ExxonMobil have denied any involvement with Dark Basin.

References

{{Hacking in the 2010s

Cyberattacks
Hacker groups
Hacking in the 2010s
Cybercrime in India