Void Balaur

Executive Summary

Void Balaur is a highly active hack-for-hire group that offers cyber mercenary services to collect private data and gain access to various online platforms such as email and social media. They have been operational since at least 2016, targeting individuals and organizations globally. Their primary activities include cyber espionage and data theft, which poses significant risks to personal and organizational security.

Goals & Targeting

Void Balaur appears to target individuals and organizations across multiple sectors globally, suggesting no specific sector or country preference. Their goals primarily seem to involve financial gain through data collection and unauthorized access. They likely cater to clients seeking to gather competitive intelligence, disrupt business operations, or engage in personal or organizational espionage.

Void Balaur operates as a cyber mercenary group specializing in providing hacking services for hire. This group has been active since at least 2016 and offers a range of services, including unauthorized access to email accounts, social media platforms, and business emails. Their targets span multiple sectors and geographies, indicating a broad operational scope. The group's ability to exploit vulnerabilities and compromise sensitive data highlights their technical proficiency and adaptability. Void Balaur's activities underscore the growing threat of cyber mercenaries who offer their services to various clients, posing significant challenges to individual and organizational security. This group’s operations reflect a broader trend in cybercrime where specialized services are increasingly commoditized and sold on public forums.

Key Capabilities

• Phishing attacks targeting social media and email platforms
• Unauthorized access to online accounts
• Data collection and exfiltration
• Maintaining persistence via compromised accounts

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Void Balaur has been active since at least 2016 and is known to target a wide range of victims globally. Their campaigns often involve compromising personal and business email accounts, leveraging social engineering techniques to gain access. Notable past operations include the compromise of numerous accounts across various platforms. The group's persistent activity suggests a high level of organizational resilience and adaptability in their operations.

IOC Patterns

• Spear-phishing emails targeting personal and business accounts
• Unusual login attempts from unfamiliar locations or devices
• Presence of unauthorized access tools in target networks

Recommended Actions

• Implement multi-factor authentication (MFA) for all critical accounts
• Conduct regular employee training to recognize phishing attempts
• Monitor network traffic for signs of unauthorized access or data exfiltration
• Deploy endpoint detection and response (EDR) solutions to identify malicious activity

Suggested Tags