A Troubling Marketplace: Stolen Government Email Accounts
▼ Summary
– Cybercriminals sell stolen government and police email accounts for as little as $40 on the dark web, enabling impersonation and system breaches.
– Credential stuffing, infostealers, and phishing are common methods used to compromise accounts, often due to weak password practices and lack of MFA.
– Stolen accounts are sold via encrypted platforms like Telegram, with some including personal details to increase their value for fraudulent activities.
– Government email accounts carry inherent trust, allowing criminals to bypass security checks and exploit legal authority for malicious requests.
– Access to sensitive law enforcement tools and databases is also traded, posing risks like surveillance and data theft beyond email compromise.
Cybercriminals have found a lucrative market on the dark web, selling stolen government and police email accounts for as little as $40. This revelation, from research conducted by Abnormal AI, sheds light on a worrying trend where these accounts, belonging to agencies in the US, UK, Germany, India, and Brazil, are traded openly on underground forums. These are not obsolete or unused accounts; they belong to active personnel, enabling malicious actors to impersonate officials and potentially compromise secure systems.
Methods of Compromise
The methods cybercriminals use to obtain these accounts are surprisingly straightforward. Credential stuffing is a common tactic, exploiting the prevalent issue of password reuse among government workers. Attackers take advantage of vast databases of previously stolen credentials, testing them against government email addresses to find matches. Infostealers, a form of malware, can also harvest credentials stored in browsers and email clients, providing bulk access to accounts for as little as $5.
Targeted phishing campaigns remain a significant threat, particularly those that target police or government staff without multifactor authentication (MFA). Such campaigns can easily trick individuals into revealing their login details, giving attackers full access with just a single password.
Selling and Exploiting Access
Once these accounts are compromised, they are sold via encrypted messaging services like Telegram or Signal. Transactions are conducted using cryptocurrency, and buyers receive all the details needed to access the email accounts using standard protocols like SMTP, POP3, or IMAP. Some sellers go further, packaging the account with personal information of the original owner to increase its value.
The strategic use of these accounts is also evolving. Criminals now openly advertise their potential uses, including filing fraudulent legal requests or bypassing online platform verifications. The authenticity carried by a government email account makes it a powerful tool in the hands of those with malicious intent.
The Power of Institutional Trust
The ramifications of this trade are profound. A government email account comes with an inherent level of trust and authority that is difficult to mimic. Legal compulsion authority allows these accounts to send urgent law enforcement requests that service providers must respond to quickly. The credibility of official domains helps them evade security checks, and their exclusive access to certain systems makes them invaluable. This makes it challenging to distinguish a fraudulent request from a legitimate one.
Risks Beyond Email
The threat extends beyond deceptive emails. Some sellers offer access to sensitive law enforcement databases and investigative tools. This includes systems for license plate lookups and internal police reporting dashboards. If abused, these tools could facilitate surveillance, data theft, and other criminal activities.
Protecting Against These Threats
The challenge for cybersecurity teams is immense. Traditional email security measures may not be sufficient, as emails from legitimate accounts can bypass usual filters. The trust placed in official addresses means recipients often do not question their authenticity.
To mitigate these risks, security teams must implement stronger authentication protocols and encourage better password practices. Agencies should also reevaluate their procedures for verifying urgent requests and restrict access to sensitive systems. By doing so, they can minimize the damage a single compromised account might cause, ensuring greater security and resilience against these emerging threats.
(Source: HelpNet Security)
