🔍During my routine investigation, I came across an IP address from Austria:-
152.53.38.103 🇦🇹
💡An Austrian IP with clean track record found collecting Sensitive US Data including US Voters List (Ohio, Florida & Georgia), Verifications Breach, Numident Records, Consumer Data Dictionary, SSA (Social Security Administration), Invalid SSN Sequence etc.
💡A dedicated folder titled BF is found, which is short for Breach Forums, which can be assumed as the primary source of Data Collection for this
💡It is also found that the group collects breaches related to the US Government from Ransomware Group like Rhysida who had compromised Columbus.Gov and Sumter County Sheriff (both are present).
💡Some of the citizens' records date back to the early 20th Century such as in 1909!
💡Hence, it can be assumed that this is a staging server for the preparation of any Fraudulent Political Campaigns maintained by any group in advance of US Elections.
💡Additionally, the group also collects data on luxurious brands such as Luxottica (Premium Eyewear), DeltaDental, Acuity (Insurance Provider), WatchMax (UK’s Diamond Jewellary) etc.
Detailed report is shared with CISA, awaiting action!
Follow me on Twitter: @RakeshKrish12
@FBI @CISA #infosec #US #election #USElection #campaign #dataleak #databreach #darkweb #OSINT #threatintel #security #infosec #hack #Election2024 #ransomware #rhysida