WOBURN, MA – June 15, 2016 – / — Kaspersky Lab researchers have investigated a global forum where cybercriminals can buy and sell access to compromised servers for as little as $6 each. The xDedic marketplace, which appears to be run by a Russian-speaking group, currently lists 70,624 hacked Remote Desktop Protocol (RDP) servers for sale. Many of the servers host or provide access to popular consumer websites and services and some have software installed for direct mail, financial accounting and Point-of-Sale (PoS) processing. They can be used to target the owners’ infrastructures or as a launch-pad for wider attacks, while the owners, including government entities, corporations and universities, have little or no idea of what’s happening.

xDedic is a powerful example of a new kind of cybercriminal marketplace: well-organized and supported, and offering everyone from entry-level cybercriminals to APT groups fast, cheap, and easy access to legitimate organizational infrastructure that keeps their crimes below the radar for as long as possible.

A European internet service provider (ISP) alerted Kaspersky Lab to the existence of xDedic and the companies worked together to investigate how the forum operates. The process is simple and thorough: hackers break into servers, often through brute-force attacks, and bring the credentials to xDedic. The hacked servers are then checked for their RDP configuration, memory, software, browsing history and more, all features that customers can search through before buying. After that, they are added to a growing online inventory that includes access to:

  • Servers belonging to government networks, corporations and universities
  • Servers tagged for having access to or hosting certain websites and services, including gaming, betting, dating, online shopping, online banking and payment, cell phone networks, ISPs and browsers
  • Servers with pre-installed software that could facilitate an attack, including direct mail, financial and PoS software

From as little as $6 per server, members of the xDedic forum can access all of a server’s data and also use it as a platform for further malicious attacks. This could potentially include targeted attacks, malware, DDoS, phishing, social-engineering and adware attacks, among others.

The servers’ legitimate owners – reputable organizations including government networks, corporations and universities – are often unaware that their IT infrastructure has been compromised. Furthermore, once a campaign has been completed, the attackers can put access to the server back up for sale and the whole process can begin again.

The xDedic marketplace seems to have opened for business some time in 2014, and has become significantly more popular since the middle of 2015. In May 2016, it listed 70,624 servers from 173 countries for sale, posted in the names of 416 different sellers. The top 15 countries affected are: Brazil, China, Russia, India, Spain, Italy, France, Australia, South Africa, Malaysia, United Kingdom, Mexico, Columbia, the United States and Germany.

The group behind xDedic appears to be Russian-speaking, and claims that it merely provides a trading platform and has no links or affiliations to the sellers.

“xDedic is further confirmation that cybercrime-as-a-service is expanding through the addition of commercial ecosystems and trading platforms. Its existence makes it easier than ever for everyone, from low-skilled malicious attackers to nation-state backed APTs to engage in potentially devastating attacks in a way that is cheap, fast and effective. The ultimate victims are not just the consumers or organizations targeted in an attack, but also the unsuspecting owners of the servers: they are likely to be completely unaware that their servers are being hijacked again and again for different attacks, all conducted right under their nose,” said Costin Raiu, Director, Global Research and Analysis Team, Kaspersky Lab.

Kaspersky Lab advises organizations to:

  • Install a robust security solution as part of a comprehensive, multi-layered approach to IT infrastructure security
  • Enforce the use of strong passwords as part of the server authentication process
  • Implement a continuous process of patch management
  • Undertake a regular security audit of the IT infrastructure
  • Consider investing in threat intelligence services which will keep the organization informed of emerging threats and offer an insight into the criminal perspective to help them assess their level of risk.

Read more about xDedic at

How to Buy and Sell Hacked Servers

About Kaspersky Lab
Kaspersky Lab is one of the world’s fastest-growing cybersecurity companies and the largest that is privately-owned. The company is ranked among the world’s top four vendors of security solutions for endpoint users (IDC, 2014). Since 1997 Kaspersky Lab has been an innovator in cybersecurity and provides effective digital security solutions and threat intelligence for large enterprises, SMBs and consumers. Kaspersky Lab is an international company, operating in almost 200 countries and territories across the globe, providing protection for over 400 million users worldwide.

Learn more at

For the latest in-depth information on security threat issues and trends, please visit:
Securelist | Information about Viruses, Hackers and Spam
Follow @Securelist on Twitter

Threatpost | The First Stop for Security News
Follow @Threatpost on Twitter

Media Contact:
Sarah Kitsos

Source: Kaspersky



General Tags: online backup news, online backup services, online backup companies, compare online backups, online backup reviews, software as a service, CEO interviews, online data backup, top rated online backups, online backup providers directory, backing up online, online file backup, SaaS, data storage, online backup, cloud computing, data security, online file storage

Like us on Facebook

Do you like this post? Subscribe to our RSS feed ===========================

Sponsored Links:

Data Deposit Box


Bacula Systems



Related posts:

  1. Kaspersky Lab Exposes the Poseidon Group: A Commercial Malware Boutique Operating on Land, Air and Sea
  2. One Billion More: Kaspersky Lab Reports on Cyber Threats in 2014
  3. Kaspersky Lab and WISeKey Launch an Encrypted Vault for all that is Precious on your Mobile: The WISeID Kaspersky Lab Security App
  4. Backup-Technology Online Data Backup Expert Tips: US Federal Reserve Bank hacked by Anonymous
  5. Kaspersky Lab Survey: Half of Companies Put Themselves at Risk by Undervaluing DDoS Countermeasures
  6. Every Fifth Company Expects Others to Protect It Against DDoS, Kaspersky Lab Survey Shows
  7. Kaspersky Lab Study: About One Third of All Phishing Attacks Aimed at Online Financial Institutions
  8. Kaspersky Lab Study Reveals Surge in Java Exploit Attacks to 14.1 Million In a Year
  9. Kaspersky Lab Detected a 14% Increase in New Ransomware Modifications in Q1 2016
  10. Massive Data Growth in the SMB Market Requires Efficient Backup Technologies

Tags: ,