'AIG' Threat Group Launches With Unique Business Model

A threat group calling itself the Atlas Intelligence Group (AIG, aka Atlantis Cyber-Army) has recently surfaced with what appears to be a somewhat different — and potentially trend-setting — cybercrime model.

Researchers from Cyberint who were the first to spot the group described the threat actor as selling a variety of services via its main website, including access to stolen databases, exclusive data leaks, distributed denial-of-service (DDoS) services, and initial access to enterprise networks via RDP clients and Web shells. Cyberint said this week that its researchers spotted AIG in May and have observed it growing rapidly since then.

What makes the threat actor different from the myriad others with similar offerings is the fact that the operators themselves appear to be entirely outsourcing the actual hacking activities to independent cyber-mercenaries who have no direct connection to the operation. For instance, when a client purchases AIG’s DDoS, data theft, or malicious spam services, the group advertises for and hires independent contractors to execute the actual tasks. That’s unlike most threat groups. which recruit and maintain the same team of hackers for different campaigns.

A Model for OpSec

AIG’s model appears designed to ensure a high level of operations security for its leaders by keeping them segregated from those doing the criminal hacking activity, according to Cyberint.

“AIG is the first group I’ve seen that is using this business model,” says Shmuel Gihon, security researcher with Cyberint. “Every team has its leaders, and every team has key members. But here it’s different: we have one leader that controls everything and everyone.”

AIG’s business model appears designed to take advantage of the growing number of hacker-for-hire groups that have begun surfacing all over the world in recent years. The groups, many of which operate out of India, Russia, or the United Arab Emirates, specialize in breaking into target networks, stealing data, and carrying out a variety of other malicious activities on behalf of the clients who hire them. One example of such a group is Russia-based “Void Balaur,” a cyber-mercenary group that researchers at Trend Micro and others have linked to attacks on thousands of organizations and individuals for several years.

Gihon says Cyberint’s analysis of AIG’s activities shows it is being run by a secretive individual using the handle “Mr. Eagle.” This individual appears responsible for initiating all AIG campaigns and plans. Cyberint has so far been able to identify at least four other individuals that are operating under this leader, and who are responsible for tasks such as advertising the group’s services, communicating with customers, and operating its Telegram channels.

“What makes them different is the fact that they are very good [at] making themselves anonymous and approaching this operation as entrepreneurs and not as technical people,” Gihon says. The group’s behavior suggests the core members — or at least its leader — were red teamers or malicious hackers that have decided to lead rather than operate.

“They have been around in the darknet and in the cybercrime industry for a while and observed how things are operating,” he added.

Telegram Communications

Cyberint said it has observed the group use three different Telegram channels, with thousands of subscribers between them, for its operations.

One of the channels is a marketplace for leaked databases. The databases appear to belong to organizations in different sectors such as government, finance, manufacturing, and technology, from around the world. The collection of databases on sale via the Telegram channel suggests that AIG isn’t focusing on any specific region or sector. Rather, the group appears to be targeting organizations that it thinks might be valuable for potential buyers.

Some of the databases are available for as little as 15 euros and contain information such as email and physical addresses, phone numbers, and other information likely of interest to distributors of malicious spam, spear-phishing groups, and hacktivists.

“AIG claims that these databases are exclusive, so the assumption is that they obtained it [via] their contractors,” Gihon says. Given the low price, it is unlikely that AIG obtained them from a third-party and is reselling them, he says.

AIG has a second Telegram channel that it uses to publish ads for various hacking services that it might be looking for, and where hackers have an opportunity to bid for contracts. The channel serves as the threat group’s source for finding malware developers, social engineers, red teamers, and other cyber-mercenaries.

AIG’s third Telegram channel, which serves as its communication channel, is where the group posts announcements, lists of intended targets, and other information. The threat actor also maintains an e-commerce store where people can purchase AIG’s services and stolen databases using cryptocurrency.

Gihon says AIG’s business model gives it a level of flexibility that other threat groups do not have.

“The leader is not bound to any one of the members because they are all contractors,” he says. “So, while other groups have their ups and downs given the fact that they are the same group of people most of the time, Mr. Eagle has the privilege to hire the best of the best anytime,” he says. “This could make this team very lethal in the end game.”