Full Report
Following the arrest of the cybercriminal behind the aliases ALTDOS, DESORDEN, GHOSTR, and 0mid16B, Group-IB provides a deep dive into his activities, uncovering striking similarities and unmasking the cybercriminal that breached more than 90 instances of data leaks worldwide over the span of four years in operation.
Analysis Summary
# Threat Actor: ALTDOS (aka DESORDEN, GHOSTR, 0mid16B)
## Attribution & Identity
- **Status:** Arrested (as per report).
- **Aliases:** ALTDOS, DESORDEN, GHOSTR, and 0mid16B.
- **Identity:** The report links these four high-profile personas to a single cybercriminal individual.
- **Associations:** While primarily operating under these distinct brand names, the actor functioned as a serial data extortionist.
## Activity Summary
- **Timeline:** Active for over four years.
- **Scope:** Involved in more than 90 instances of data leaks and breaches worldwide.
- **Campaigns:** The actor transitioned between different aliases, each associated with aggressive data theft and extortion operations. The "DESORDEN" persona was notably active in high-profile breaches across Southeast Asia, while "ALTDOS" focused on targeting corporate entities for financial gain through public shaming and ransom demands.
## Tactics, Techniques & Procedures
The actor demonstrated a consistent focus on data exfiltration for the purpose of extortion:
- **Initial Access:** Exploitation of known vulnerabilities in software and firmware.
- **Remote Access Abuse:** Utilization of Remote Desktop Protocol (RDP) for persistence and lateral movement.
- **Privilege Escalation:** Targeting dormant or poorly managed accounts to gain administrative access.
- **Evasion:** Deployment of backdoors and penetration testing frameworks to maintain access while evading standard security controls.
- **Extortion:** Publicly leaking snippets of stolen data to pressure victims into paying ransoms (double extortion without necessarily using ransomware).
**MITRE ATT&CK Mapping (Inferred):**
- Exploit Public-Facing Application [T1190]
- External Remote Services (RDP/VPN) [T1133]
- Valid Accounts [T1078]
- Exfiltration Over C2 Channel [T1041]
- Data Encrypted for Impact (Extortion focus) [T1485]
## Targeting
- **Sectors:** Multiple industries, with a strong focus on high-value corporate data.
- **Geography:** Worldwide distribution, with significant activity noted in the APAC region (Southeast Asia).
- **Victims:** Over 90 organizations were breached; while specific names are not listed in the summary, the actor targeted large-scale data instances.
## Tools & Infrastructure
- **Malware:** Custom backdoors and popular penetration testing frameworks (e.g., Cobalt Strike or similar).
- **Remote Access:** RDP and VPN services.
- **Infrastructure:**
- Used various domains for data leaking and public communication (e.g., dedicated leak sites for the DESORDEN and GHOSTR personas).
- Defanged Infrastructure: [h]xxps[:]//group-ib[.]com/blog/altdos-desorden-ghostr-0mid16b (Report Source).
## Implications
The consolidation of these four aliases into a single actor reveals a highly prolific and adaptive threat. The actor's ability to rebrand allowed them to maintain operational momentum despite increased law enforcement scrutiny. This case underscores that "independent" threat groups in the extortion landscape are often the work of a single experienced individual or small core cell, rather than large disparate organizations.
## Mitigations
- **Access Control:** Implement Multi-Factor Authentication (MFA) on all VPN and remote access points.
- **RDP Security:** Disable unnecessary RDP access; restrict necessary RDP to trusted, whitelisted IP addresses.
- **Vulnerability Management:** Maintain a strict patch management policy for all firmware and software.
- **Network Defense:** Implement network segregation and strict firewall rules to prevent lateral movement.
- **Account Hygiene:** Regularly audit and disable dormant accounts.
- **Endpoint Protection:** Deploy Endpoint Detection and Response (EDR) to identify unauthorized penetration testing tools.
- **Data Protection:** Encrypt sensitive data at rest and in transit to mitigate the impact of exfiltration.