YOUNG, WILD AND FREE — FBI Director Chris Wray likes to say that Chinese hackers outnumber FBI investigators more than 50-1. But for now, one of the greatest hacking threats bedeviling the bureau is much closer to home — and still well below the legal drinking age. Two weeks ago, a previously little-known cybercriminal group that private sector researchers believe is made up of teenagers and young adults from the U.S. and the U.K. burst onto the public radar after bringing slot machines to a halt at MGM Resorts and extracting an eight-figure ransom from Caesars Entertainment for an earlier cyberattack. But those who have been tracking the group for well over a year say the Las Vegas hacks are just the tip of the iceberg, John reports. Despite garnering little attention until recently, the group has been riding roughshod through some of the largest American companies for months now. And, researchers say, their success is symptomatic of the broader struggles Western law enforcement is facing with juvenile cybercrime — even when coming from its own backyard. “The narrative with a lot of cybercriminals is like, ‘Oh, they’re an untouchable Russian hacker in a non-friendly country,’” Allison Nixon, chief research officer at Unit221B, a digital forensics company, told MC. “But with this phenomenon, they’re not Russian hackers. They live in Five Eyes countries, and some of them are underage.” Teenage dream — Researchers at Mandiant, CrowdStrike and SentinelOne interviewed for this newsletter expressed confidence that the perpetrators of the Vegas hacks are a small group of individuals between the ages of 17 and 24 based in the U.K. and the U.S, while acknowledging they are not 100 percent certain of the identity, location or the exact number of perpetrators. All said the group emerged from an English-language Telegram channel known as the Com, where mostly high-school-aged individuals bond over a range of illicit activity, from sextortion schemes and fraud to blackmail. The FBI did not respond to a request for comment about the Com or the identity of the lead suspects in the casino hacks. Below age, above the law — Many Western jurisdictions limit how harshly minors can be penalized for crimes, while U.S. law generally requires that juvenile hacking prosecutions be tried in state court, constraining what federal law enforcement can do about the Vegas hackers or groups like the Com. Adam Meyers, a senior vice president at cybersecurity firm CrowdStrike, said another obstacle is how difficult it is for law enforcement to link an online persona to a real-world crime. “When it comes to law enforcement, they have a higher burden of proof,” he said. Sweet talkers — While they remain free, the Vegas hackers have been wreaking havoc through a mix of techniques to subvert SMS-based two-factor authentication — a common way companies protect their employees’ accounts. They have also found clever methods to use the access they get from one victim, like an IT provider, to lily pad into another. The group is adept at SMS phishing, sim-swapping and social engineering, often by phone. “If you have a native English speaker, people aren’t going to necessarily t hink something’s weird or out of place,” said Kimberly Goody, the head of financial crime analysis for Google Cloud's Mandiant. Appearances can be deceiving — Meyers, Goody and Nixon all cautioned that people’s dismissive reaction to those techniques, and the group’s age, have led them to underestimate it. But Meyers said CrowdStrike believes a group of just 3-4 individuals is responsible for roughly 50 intrusions in the last 18 months. And while it once focused on smaller scale crime, like crypto heists, the group has recently doubled-down on extortion. “We've been trying to say that this is a big deal, and people didn't listen until we had this highly visible incident with MGM,” said Mandiant’s Goody. Dangerous liaisons — Perhaps most troublingly, in April, the small group believed to be behind the Vegas hacks began deploying ransomware it rented from a prolific Russian-language crime group, AlphV. For researchers, the unusual alliance set off alarm bells because it suggested that cybercriminals from Russia and Eastern Europe were beginning to recruit minors from the West. Established gangs are “specifically targeting children for recruitment … because these jobs are high-risk and they know the cops have limited options to punish minors,” said Unit221B’s Nixon.
| 
