GINC-APT-0326 · Criminal

OurMine

Also ATK 128, ATK128, TAG-HA10.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Saudi Arabia(high confidence)
Motivation
Financial gain
Seen
2016
Sources
6 sources carry it
Identifier
GINC-APT-0326 · ourmine

What it is

OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services. (Trend Micro) In light of the recent report detailing its willingness to pay US$250,000 in exchange for the 1.5 terabytes’ worth of data swiped by hackers from its servers, HBO finds itself dealing with yet another security breach. Known for hijacking prominent social media accounts, the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network. These include accounts for HBO shows, such as “Game of Thrones,” “Girls,” and “Ballers.” This is not the first time that OurMine has claimed responsibility for hacking high- profile social networking accounts. Last year, the group victimized Marvel, The New York Times, and even the heads of some of the biggest technology companies in the world. Mark Zuckerberg, Jack Dorsey, Sundar Pichai, and Daniel Ek — the CEOs of Facebook, Twitter, Google and Spotify, respectively — have also fallen victim to the hackers, dispelling the notion that a career in software and technology exempts one from being compromised.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Thales
ATK128
Other names
ATK 128, TAG-HA10

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
United Kingdom, United States
Sectors
Casinos and Gambling, High-Tech, Media, Telecommunications

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate
  • Hacking Team UEFI Rootkit

Sources