- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial gain
- Seen
- 2017
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0258 · void-balaur
What it is
Void Balaur is a highly active hack-for-hire / cyber mercenary group with a wide range of known target types across the globe. Their services have been observed for sale to the public online since at least 2016. Services include the collection of private data and access to specific online email and social media services, such as Gmail, Outlook, Telegram, Yandex, Facebook, Instagram, and business emails.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Rockethack
Targets
- Countries
- Armenia, Australia, Belarus, Belgium, Brazil, Canada, Central African Republic, Czech, Egypt, France, Georgia, Germany, India, Italy, Japan, Kazakhstan, Moldova, Netherlands, New Zealand, Norway, Poland, Portugal, Russia, Slovakia, South Africa, Spain, Sudan, Sweden, Taiwan, Türkiye, Ukraine, United Arab Emirates, United Kingdom, United States, Uzbekistan
Tools
The tools and malware families the sources tie to it.
- CrossRat
- Cyber Eye RAT
- CyberGate
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de