70000 Pakistani Banks’ Cards with PINs Go on Sale on the Dark Web
Group-IB experts discovered new databases with a total of 69,189 Pakistani banks’ cards that have shown up for sale on the dark web.
Group-IB, an international company that specializes in preventing cyberattacks, has discovered new databases with a total of 69,189 Pakistani banks’ cards that have shown up for sale on the dark web. The total market value of the databases is estimated at nearly 3.5 million USD. According to Group-IB data, it is the second big sale of Pakistani banks’ cards in the past 6 months, which may indicate the activity of advanced financially motivated threat actors in the region.
Double trouble for Pakistani banks
Group-IB Threat Intelligence
team has discovered two new databases with tens of thousands of Pakistani banks’ cards that were releases on Joker’s Stash, one of the most popular underground hubs of stolen
card data, at the end of January 2019. 96%
of all card dumps, unauthorized digital copies of the information contained in magnetic
stripe of a payment card, were related to a single bank – Meezan Bank Ltd. Pakistani banks’ cards are rarely sold on underground
cardshops. This, and the fact that all the cards came on sale with PIN codes
explains the high price, which was kept at 50
USD per card, while usually the price per card on dark web forums ranges
from 10 to 40 USD.
First set of dumps, titled <>, was set up for sale on Jan. 24, 2019 and
included 1,535 cards, 1,457 of which were issued by Meezan Bank Ltd. It is
worth noting that this batch of cards was not announced on the forum.
The second database was put up on Joker’s Stash on January 30th.
The <> set, comprised
of the details of 67,654 cards of
Pakistani banks was significantly larger. The sellers marked the set as “high
valid” and, unlike the first set, advertised the database on all major
underground forums such as (<>, <>, <> etc.). 96% of all
cards in the set were also related to Meezan Bank Ltd.
“The scale, volume, frequency and connection to one institution contributes
to the theory that the leak might be involved in a larger incident, potentially
an advanced actor gaining access to card systems within Pakistan,” – comments Dmitry Shestakov, Head of
Group-IB ?ybercrime research unit.
Why on earth would
anyone bother?
Those who buy the cards on dark web forums can
use card dumps data to produce cloned credit cards. Then money mules use these
fake cards to either withdraw money from ATMs or buy goods in, which are later
resold by fraudsters. Another scheme of cashing out involves the use “white
plastic” dumps (cloned cards) and dummy companies (linked to money mules) with
bank accounts and POS terminals: fraudsters use “white plastic” to buy nonexistent
goods, and funds from compromised cards get transferred to bank accounts linked
to dummy companies, then cybercriminals withdraw money via ATM using a bank
card which is linked to a dummy company. This method is quickly detected by
antifraud systems and involves high risks. However, emerging markets banks
frequently do not have adequate anti-fraud controls, making this attack type
viable.
Give ’em a break
Earlier In November 2018, Group-IB Threat
Intelligence team already reported
about massive leaks of 177,878 payment cards of Pakistani and other
international banks. The banks affected by this breach included major Pakistani
banks financial organizations such as, Habib Bank, MCB Bank Limited, Allied
Bank Limited and many others. Prior to the November leak, Group-IB experts
detected two smaller Pakistani banks’ compromised cards uploads to the cardshop.
The first one occurred on Oct. 26 and had 10,467 payment cards, another set surfaced
on the dark web on Oct. 31 and included 11,795 cards issued by the leading
Pakistani and other regions’ banks.
Group-IB Threat Intelligence continuously detects and analyses data uploaded to card shops all over the world. According to Group-IB’s annual Hi-Tech Crime Trends 2018 report, on average, from June 2017 to August 2018, the details of 1.8 million payment cards were uploaded to card shops monthly.
About the author Group-IB:
Group-IB is a leading provider of solutions aimed at detection and prevention of cyberattacks, online fraud, and IP protection. GIB Threat Intelligence system was named one of the best in class by Gartner, Forrester, and IDC.
This post 70000 Pakistani Banks’ Cards with PINs Go on Sale on the Dark Web originally appeared on Security Affairs.
