- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Saudi Arabia(high confidence)
- Motivation
- Financial gain
- Seen
- 2016
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0326 · ourmine
What it is
OurMine is known for celebrity internet accounts, often causing cyber vandalism, to advertise their commercial services. (Trend Micro) In light of the recent report detailing its willingness to pay US$250,000 in exchange for the 1.5 terabytes’ worth of data swiped by hackers from its servers, HBO finds itself dealing with yet another security breach. Known for hijacking prominent social media accounts, the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network. These include accounts for HBO shows, such as “Game of Thrones,” “Girls,” and “Ballers.” This is not the first time that OurMine has claimed responsibility for hacking high- profile social networking accounts. Last year, the group victimized Marvel, The New York Times, and even the heads of some of the biggest technology companies in the world. Mark Zuckerberg, Jack Dorsey, Sundar Pichai, and Daniel Ek — the CEOs of Facebook, Twitter, Google and Spotify, respectively — have also fallen victim to the hackers, dispelling the notion that a career in software and technology exempts one from being compromised.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Thales
- ATK128
- Other names
- ATK 128, TAG-HA10
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTSaudi Arabia
- ThreatActor.info (Malpedia et al.)Saudi Arabia
Targets
- Countries
- United Kingdom, United States
- Sectors
- Casinos and Gambling, High-Tech, Media, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Hacking Team UEFI Rootkit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de