'Luuuk' bank fraud nets $680K in one week via ATM cash-out

As EMV makes card skimming less profitable in Europe, criminals are finding new ways to access accounts. But they're still cashing out their stolen proceeds at ATMs.
Kaspersky Lab experts have discovered evidence of a targeted attack against the clients of a large European bank. The organizers of the bank fraudLuuukused a man-in-the-browser campaign to steal more than a half-million euros ($680,000) from accounts at the bank, according to logs from the server used in the attack.
The first signs of the campaign were discovered on Jan. 20 when Kaspersky Lab detected a command and control server on the net. The server’s control panel indicated evidence of a Trojan program used to steal money from clients’ bank accounts.
On the server, Kaspersky discovered transaction logs that listed sums of money taken from each account. In all, more than 190 victims could be identified, most of them located in Italy and Turkey. According to the logs, amounts stolen ranged from 1,700–39,000 euros ($2,310–$53,000) per account.
The campaign was at least a week old when it was uncovered. Two days after the discovery, the criminals removed all evidence that might be used to trace them.
“Soon after we detected this C-and-C server, we contacted the bank’s security service and the law enforcement agencies, and submitted all our evidence to them,” said Vicente Diaz, principal security researcher at Kaspersky Lab.

Malicious tools
With the Luuuk case, experts have grounds to believe that important financial data was intercepted automatically and fraudulent transactions were carried out as soon as the victim logged onto their online bank accounts.
“On the C&C server we detected there was no information as to which specific malware program was used in this campaign," said Vicente Diaz, principal security researcher at Kaspersky Lab. "However, many existing Zeus variations — Citadel, SpyEye, IceIX, etc. — have that necessary capability. We believe the malware used in this campaign could be a Zeus flavor using sophisticated web injects on the victims."
Money divestment via ATM
The stolen money was passed on to the cybercriminals’ accounts in an unusual way, Kaspersky said. Participants in the scam received some of the stolen money in specially created bank accounts, which were cashed out via ATMs.
There was evidence of several different ‘drop’ groups, each assigned a different sum of money. One group was responsible for transferring sums of 40,000–50,000 euros, another with 15,000–20,000 euros and a third with no more than 2,000 euros.
“These differences in the amount of money entrusted to different drops may be indicative of varying levels of trust for each drop type," said Diaz. "We know that members of these schemes often cheat their partners in crime and abscond with the money they were supposed to cash. The Luuuk’s bosses may be trying to hedge against these losses by setting up different groups with different levels of trust: The more money a drop is asked to handle, the more he is trusted."
The server related to Luuuk was shut down shortly after the investigation started. However, the complexity level of the MITB operation suggests that the attackers will continue to look for new victims of this campaign. Kaspersky's investigation into Luuuk activities is ongoing, the company said.

New Bank login Cashout Method Via Money Transfer Appplication.

FraudAction intelligence researchers have engaged a fraudster in an online chat, in which he offered a cashout method for compromised bank accounts by abusing the Azimo and Small World money transfer apps. During the transfer, the mule account would be concealed behind a special one-time bank account that these apps provide for single transfers, serving as an account in the middle. 

Prerequisites

• A compromised bank account
• A mule account linked to an Azimo or Small World account

Procedure

• Download and open one of Azimo or Small World apps.
• Fill in the form with the transfer details.
• In the checkout, select ‘Bank Transfer’, and you will be given a special bank account number just for the specific transfer.
• Make a regular bank transfer from the compromised account to this special account.
• The money will be forwarded to the mule account.

The following conversation with a fraudster details how they leverage this method using legitimate apps:

As we know, fraudsters are always looking for new cashout methods and often abuse legitimate services to do so.  Mitigation lies in awareness of the phenomenon and fine-tuning threat detection in your organization regarding the use of third party online money transfer services such as the apps mentioned in this report.

Dorks for SQL Injection hacking

Best cc hacking dorks to hack shops with credit cards. 

cat.asp?cat=
productlist.asp?catalogid=
Category.asp?category_id=
Category.cfm?category_id=
category.asp?cid=
category.cfm?cid=
category.asp?cat=
category.cfm?cat=
category.asp?id=
index.cfm?pageid=
category.asp?catid=
Category.asp?c=
Category.cfm?c=
productlist.cfm?catalogid=
productlist.asp?catalogid=
viewitem.asp?catalogid=
viewitem.cfm?catalogid=
catalog.cfm?catalogId=
catalog.asp?catalogId=
department.cfm?dept=
department.asp?dept=
itemdetails.cfm?catalogId=
itemdetails.asp?catalogId=
product_detail.asp?catalogid=
product_detail.cfm?catalogid=
product_list.asp?catalogid=
product_list.cfm?catalogid=
ShowProduct.cfm?CatID=
ShowProduct.asp?CatID=
search_results.cfm?txtsearchParamCat=
search_results.asp?txtsearchParamCat=
itemdetails.cfm?catalogId=
itemdetails.asp?catalogId=
store-page.cfm?go=
store-page.asp?go=
Detail.cfm?CatalogID=
Detail.asp?CatalogID=
browse.cfm?category_id=
view.cfm?category_id=
products.cfm?category_id=
index.cfm?Category_ID=
detail.cfm?id=
category.cfm?id=
showitems.cfm?category_id=
ViewProduct.asp?PID=
ViewProduct.cfm?PID=
shopdisplayproducts.asp?catalogid=
shopdisplayproducts.cfn?catalogid=
displayproducts.cfm?category_id=
displayproducts.asp?category_id=
DisplayProducts.asp?prodcat=
DisplayProducts.cfm?prodcat=x
productDetail.cfm?ProductID=
products.php?subcat_id=
showitem.cfm?id=21
productdetail.cfm?pid=
default.cfm?action=46
products_accessories.asp?CatId=
Store_ViewProducts.asp?Cat=
category.cfm?categoryID=
category.asp?category=
tepeecart.cfm?shopid=
view_product.asp?productID=
ProductDetails.asp?prdId=12
products.cfm?ID=
detail.asp?product_id=
product_detail.asp?product_id=
products.php?subcat_id=
product.php?product_id=
view_product.cfm?productID=
product_details.asp?prodid=
shopdisplayproducts.cfm?id=
displayproducts.cfm?id=
Will add more...

WHITE LIST - The list of real bank logins providers - TESTED ONLY

This is tested bank logins providers. They are tested by ourself or by our friends, our partners. Just go straigh to add them but you should test them again with the steps I have published before.We also publish their website or their Youtube chanel (if available) beside:
(Only Yahoo! IDs are published here. Will add more ICQ contacts next time)
1. ademolasail - TRUSTED C-C seller
2. matthuguley - TRUSTED C-C seller
4. bambas.king - TRUSTED UK C-C seller
5. blaiserino_cvv2 - TRUSTED C-C seller
6. mrlongstuff - TRUSTED C-C seller ( Tested with big stuff)
7. mass_angle - TRUSTED BANK LOGINS(?) AND DUMPS provider (Tested with dumps only, not tested bank login yet)
8. luislogs_688 - TESTED BANK LOGIN PROVIDER. He is a profestional developer of a large botnet network that can collect hundreds of logins everyweek. Check more about botnet online. Reviews link 
9.  vekariyapravin99 - TRUSTED BANK LOGINS provider (Tested with Scotia logins and all good. Reviews link).

(Updated on 15/9/2017)---------------------------
To be continued ...
(If you are a real provider and wishing to be added to  this list, just contact us for tests Trustedcasher@gmail.com)
------------
(To report scammers/rippers, leave your email address so I can ask for proof of the ripper that you want to report. Don't just leave a comment to say something like "xxx is a ripper", "yyy is fake", blah blah... I can't blacklist xxx, yyy,... bcos I don't have any proof to do that.) Thank you!

How to get real bank login providers and avoid rippers?

There are many rippers today. In our opinion, there are thousands of sellers, providers on the internet but over 90% are rippers. They always talk too much and show too many products. It seems they have everything, something small like us c-c some bigger like dumps, some other said to have "bank login". But all of them have nothing. They have the same problems:
- Never talk about proofs. When you ask for proofs they will keep silent, some of them say that they don't  have time, they are too busy... (maybe they were talking to Obama loool...)
- Always sell whole stuff (100c-cs up, 10 dumps up ...loool)  to get big money one time then run.
- No sample even paid sample.
- Don't dare to provide real location that they are living (Country or city level)
So if you wanna beat them it's not hard, follow this guide:
WHEN YOU WANNA BUY BANK LOGINS, YOU NEED TO DO THIS STEPS:
1. Look for trusted contacts (or seem to be trusted) by these tips:
 -  Get trusted contacts from your trusted friends or partners.
 -  Go to some websites similar to www.trustedcasher.blogger.com to read reviews and choose good contacts.
 - Search providers on Youtube.com: Only choose providers who is showing bank login videos. Stay away provider showing their bank login in pictures, they are fake 100%.
2. Contact, talk bussiness:
 - The real provider is the one who stays online whole day, night (for work and help their partners)
 - Trusted providers talk as a smart and profestional people.
3. TEST THEM:
 - To test them, you need to ask them about proofs of their products or services. Just go straigt to ask them for BANK LOGIN SCREENSHOT WITH CURRENT (OR NEWEST) DATE AND TIME ON SITE that shows balance and other infos.
- If you are about to buy some C-v-v, dont buy big stuff. Just buy one or two c-c to see if it's good or not. (So pls prepare some LR to do this)
- Ask them about some rare or nonsense items like: Do you have dumps with pin or UK c-c with pin 456789? If they say "YESSSS" that means they are stupid rippers, just stay away.

---------------------------------------
That's what we got, just follow those step then you will beat all rippers to the hell. Thanks for reading. Leave some comments if you think this is helpful.

Black List - RIPPERs and SCAMMERs contacts are here - Beware of them

These are RIPPERs and SCAMMERs contacts. And these contacts are reported by our team, our friends and our partners.

1. spy.h3xor - Africa - fake provider

2. sunnymumbai - India - Fake c-c seller

3. alexhincu - Fake provider

4. youcancomein - Fake provider and fake casher

5. makemilliondollars - is youcancomein's other ID

6. cvvclub - 100% c-v-v fake seller

7. cvvmasters69 - fake c-v-v seller

8. cvvsuper - fake c-v-v seller

9. Hacksharp or leader.workĥ

10. tuchacker@yahoo.come

11. Anastasia.candy a funny ripper

12. Sparow133 newest updatee

13. zer0dump@yahoo.co.uk a stupid ripper 

New ripper: Azamatdombrowsky. Thanks for reporting this bastard.

13. luislogs688 is a ripper (His ID is similar  to luislogs_688's ID who got many good reviews from buyer.)

14. abndumps@mail.ru (ICQ: 30333003) is the most dangerous ripper. He built a website at address http://abndumps.com/contact/ and sound like a good seller but in fact he ripped our friend for 300usd. We also receive 5 reports from our site visitors about his ripping job. He has ripped them 560usd in total. Stay away this guy if you don't want to lose money. Tell all your friend to beware.

(Updated on 17/6/2016).
To be continued update...

--------------------------------------------------------------------

Leave comment or contact us: trustedcasher@gmail.com to report scammers. (Leave your email address so I can ask for proof of the ripper that you want to report. Don't just leave a comment to say something like "xxx is a ripper", "yyy is fake", blah blah... I can't blacklist xxx, yyy,... bcos I don't have any proof to do that.) Thank you!

About us

We build this blog to connect all profestional cashers. In this blog, we will exchange cashing out guides (private posts for trusted members). We also publish Black list that will contain RIPPERs contact so everyone knows and avoids, White list is a list of good providers for BANK LOGINS and other stuffs.
If you have any good information, just leave us some comments to help each other to avoid RIPPERs, SCAMMERs. Thanks all.