Comical Hacker Blunders: Lessons from Cyber Crime Mistakes

Hackers often fall victim to their own mistakes, leading to their capture and downfall.

### The Comical Blunders of Hackers: Learning from Mistakes
* 😅 In the world of cybercrime, even the most skilled hackers can make critical mistakes that lead to their downfall, reminding us that "**we're all human**."
* 🔍 One notable case involves Luan B, who was caught after **leaking sensitive information** and connecting his online persona to his real identity through social media, leading to his **arrest**.
* 🎭 The infamous Hector Monsour, aka Sabu, was apprehended for mistakenly joining an IRC chat without proper anonymization, demonstrating the **risks of complacency in security practices**.
* 📉 The exposure of personal data, such as the **addresses and passwords of 659 Brazilian federal police members**, highlights the **severe consequences of careless information handling**.
* 💻 Password reuse emerged as a fingerprint for tracking hackers, with a significant breach involving **87,000 US government personnel details** linked back to a user named **US DOD**.
* 💰 Milan Yim's **$243 million crypto heist** ended in arrest after he recorded himself transferring funds and flaunting his wealth, showcasing the **dangers of poor operational security (opsec)**.
* 🔒 Many hackers have been caught due to their **inability to maintain anonymity**, such as leaking their **IP addresses** or failing to utilize **VPNs**, which can easily lead to their **identification**.
* 🔑 Ultimately, the lessons from these blunders serve as a reminder that **maintaining a clean digital footprint and robust security practices** is crucial for anyone operating in the cyber realm.

On December 10th of 2022, a user by the name of US DOD published a post on the breached cybercrime market forum titled infrguard.org full database 2022 XS Edition. Included inside these posts are sample data sets of US Government Personnel, claiming a total of 87,000 full user details of US government employees, high-value individuals, and the FBI. At this point, the employee information leaked, and now this employee information leaked. Now fast forward approximately a year and a half later to July 21st of 2024. A database file of more than 4 terabytes of data had been released on a prolific cybercrime community breach forum, claiming to have more than 2.9 billion records of national publicdata.com or NPD data, one of the largest data breaches of all time if that claim was true. Now the poster of this forum post, US DOD, flashback to January 22nd of 2022. A post on a thread in the once-popular raid forums had been populated. The email

address and passwords of 659 members of the Brazilian federal police had been offered, and of course, the poster is being us DOD. As you might see, there is a pattern here: issuing personal information, sensitive records, database files for sale on various cyber crime market forms for this individual's hustle, selling to the highest bidder, and hopefully making a profit along the way. The issue is selling this momentous amount of personal information on what claimed to be 35% of the total population of the world. If that really was true, and exposing high-value powerful government employees and officials, well, it puts you on the spotlight. It puts you on the purview of people who actually have power and resources to track you down. I got to erase a lot of stuff if you're going to run this high-stakes hustle. One must ensure that our affairs are in order, digital footprint clean and concise, opsc optimized, and the real-life identity is separated from your digital identity. And that's exactly what Luan BG didn't do or us DOD suspected cyber criminal Luan BG.

took the gamble not only leaking large amounts of public information on government employees but also exposing a 100,000 indicator of compromise or IOC list from one of the largest service secured companies in the world, CrowdStrike, a company that has the global footprint and threat intelligence to at least track or hone in on individuals. So how did Luan B get caught? Well, it was evidence collected by CrowdStrike, and they were able to link US DOD's true identity between his online personas and his social media accounts. They issued this report to the government employees, and they were able to take that and arrest him. So, too many high-profile targets, too little optimization on the ENT end, and well, for as many stealthy hackers as we have, there's a much larger pool of wannabe or bad hackers, AKA script kitties, one maybe could even say myself. And so for today's video, we're going to be looking at some of the worst hacker mistakes of all time, specifically five examples. These are almost just like comical examples. Let's

talk about boastfulness for a moment. So, we all like to share accomplishments, maybe perhaps how successful we are, what job we got, how much material possessions we have, money, stuff like that. I've talked about this often in the past. The number one way that cyber criminals and hackers get caught is through their opsec blunders. Take a most recent comical example, Milan Yim and the $243 million crypto heist. The dude records himself actively transferring the funds to a compromised wallet, posing as a Google Gemini support employee, and then, you know, for a boastful moment, records that, shares it to his friends, says that we're in, and one month later, arrested because he not only was doing recordings of himself but also living this high-class lifestyle, spending $500,000 a night. Could you call this individual a hacker or somebody who perhaps just got lucky, maybe a little bit of both? So, your opsec matters, and this is a general one, but you see these mistakes time and time again on uh

various different news outlets speaking of OPC. What better way to get authorized access into luxury goods than to hack a fingerprint scanner system, delete the authorized fingerprints, and then add in your own fingerprints in hopes of, you know, maybe getting that physical access to those luxury goods. This is exactly what a hacker did in 2018 to a luxury goods retail provider. The security firm Dark Trac had tracked this threat actor who had broken into the fingerprints scanner software, and this scanner software was acting differently than the other nine respective ones. Gave that fingerprint over to the authorities and were able to subsequently rust the individual. Yikes. The WHOIS database is quite useful. In fact, as a security practitioner myself working for a large-scale organization, I often probe the WHOIS to see if we own an internal or external domain. It's nice for domain attribution. Most often, WHOIS records document or record who manages and owns a particular domain name, and oftentimes these are behind privacy-preserving services that the hosting providers provide, which masks their own individual identities so that they're

not getting spam mail or phone calls now. It's quite surprising to actually find how many individuals hackers use their personal information linked to specific domains. Oftentimes, this is through a transitive list of email addresses and online user aliases, connecting all of the different domains together. Hackers can often be tracked to identify their personal domain through old and stale DNS records, as well as a transitive association. Brian Krebs from Krebs on Security does a great job explaining his investigation in terms of attempting to find an individual's real-life identity using the passive DNS, DNS records, WHOIS records, and really trying to chain this all together. And you'd be surprised how often he actually does this through his reports, so check out his blog if you're interested in that kind of investigation. Most of us know that password reuse is a bad practice, even if we're lazy. Most of us know we shouldn't do that. But what if you could use reused passwords as a fingerprint for tracking hacker identities? This is exactly what happened.

to hackers who had, uh, happened to reuse their passwords on Hanza and Alpha Bay. These were prolific dark web marketplaces in the late 2010s. Now, authorities were able to actually capture the credentials and take down these two web marketplaces. This other dark market web place called Dream Market kind of fulfilling that need as those two went down. Um, well, what happened was authorities were able to use some of those captured credentials and break into various vendor accounts on the dark market web marketplace. So, they were able to actually capture the, uh, attacker identities from that by using their old passwords on their, um, old web marketplace accounts. IP addresses can serve as pseudo unique identifiers to hone in on individuals semi. Now, there are numerous examples. You'll see these often in security articles where an individual leaks their IP address online. Perhaps it's not connecting through a VPN or logging onto a forum with a real-life IP address or perhaps just connecting to applications. There are many, many blunders in this, and as an example, uh, the prolific leader of

lutc back in the 2010s. Hector Monsour, if I could say that night, AKA Sabu, got caught by accidentally connecting to an IRC chat without first using anonymizing services. And this was just like one or two times he did this out of the thousand times he was doing this. Now, lsy was a prolific hacking group at the time, responsible for some very large-scale attacks or compromises, specifically the PlayStation Network, as well as taking the CIA website offline. Now, after getting caught, Hector cooperated with authorities, leading to other high-profile hacker arrests and takedowns, which then leads to another mistake which kind of blends in with obsc, which is if you get too close to a group and you trust one another but then you get caught, one of your members gets caught, the likelihood that the others end up riding each other out is probably a little bit more higher chances if that lessens your sentence. And that's exactly what happened in this case. So, yet another thing to think about.

a fun little video compilation of a few mistakes made by maybe some pseudo or script kitty-like hackers. Now, we're all humans. I mean, we make mistakes, right? And if you are an individual who is performing cyber crime, it works in both ways, as in, you know, it only takes one way to get into a business or into your own personal account. It's the same way it works both ways. So, when you have to control and create this alias, uh, this online personal identity, and you're doing bad things, and then oftentimes maybe you're in a place of vulnerability, well, one mistake can lead to your downfall. So, uh, it works both ways. Hopefully, you found this video entertaining, a bit informative, and until the next time, you know what it is, have a good day.

the dumbest hackers of all time.

Grant Collins

The Dangers of Boastfulness in Cybercrime

Boastfulness can lead to significant opsec blunders, as seen in the case of Milan Yim, who recorded his $243 million crypto heist and shared it with friends, resulting in his arrest.

Cybercriminals often reuse passwords, leading to their capture, as demonstrated by the takedown of dark web marketplaces like Hanza and Alpha Bay.

Leaking IP addresses and failing to use VPNs are common mistakes that can expose individuals' identities and lead to their downfall.

Hacking Luxury Goods: The 2018 Fingerprint Scanner Incident

A hacker gained unauthorized access to a luxury goods retail provider by manipulating a fingerprint scanner system in 2018.

The security firm Dark Trac tracked the threat actor and provided the fingerprint data to the authorities, leading to the individual's arrest.

The WHOIS database is a valuable tool for security practitioners, helping to attribute domain ownership and manage internal or external domains.

The Impact of Personal Information in Cybercrime

Hackers use personal information linked to specific domains, often through a transitive list of email addresses and user aliases.

Brian Krebs investigates hacker identities using passive DNS, DNS records, and WHOIS records.

A significant data breach in 2022, claiming 87,000 US government employee records, was followed by a 2024 release of over 2.

9 billion records, one of the largest data breaches ever.

The Downfall of Hector Monsour and Luan BG

Hector Monsour, aka Sabu, got caught by connecting to an IRC chat without anonymizing services, leading to his cooperation with authorities and the arrest of other high-profile hackers.

The sale of personal information and sensitive records from 659 members of the Brazilian federal police put Luan BG, a suspected cyber criminal, in the spotlight.

The high-stakes hustle of selling personal data exposed powerful government employees, increasing the risk of being tracked down.

The video highlights the common mistakes made by pseudo or script kitty-like hackers, emphasizing that everyone makes errors.

One hacker, Luan B, was caught after leaking sensitive information and being linked to his true identity by CrowdStrike.

The video aims to entertain and inform viewers about the worst hacker mistakes, showcasing five comical examples.